What is the CVSS score of EUVD-2026-47451?

EUVD-2026-47451 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle E-Business Suite EUVD-2026-47451

| CVE-2026-61264 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-m7ch-9xwg-7223

Authentication Bypass Oracle E Business Suite

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable HTTP surface with low-privilege auth required; bounded partial read/write impact on CCT data only, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:08 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

MEDIUM 5.4

DescriptionCVE.org

Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: RDBMS and UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Call Center Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Call Center Technology accessible data as well as unauthorized read access to a subset of Oracle Call Center Technology accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Partial authorization bypass in Oracle Call Center Technology (E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read a subset of sensitive CCT data and perform unauthorized insert, update, or delete operations against that data over HTTP. The RDBMS and UI component fails to enforce access boundaries for authenticated sessions, exposing data integrity and partial confidentiality. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the Oracle Security Alert tag of 'Authentication Bypass' warrants prompt patching in internet-accessible deployments.

Technical ContextAI

Oracle Call Center Technology is a module within Oracle E-Business Suite (EBS), a large-scale enterprise application suite used in contact center and CRM workflows. The affected component spans both the RDBMS layer (back-end PL/SQL procedures, database access controls) and the UI layer (front-end application tier). The vulnerability is tagged 'Authentication Bypass,' indicating the access control enforcement between different privilege levels within the application is deficient - a low-privileged session can cross authorization boundaries to interact with data objects it should not have access to. No CWE was formally assigned by NVD, but the pattern fits CWE-285 (Improper Authorization) or CWE-863 (Incorrect Authorization). Affected CPE covers EBS versions 12.2.3 through 12.2.15. The attack surface is the HTTP application tier, consistent with EBS's standard three-tier architecture (client/application server/database).

RemediationAI

Apply the patch released as part of Oracle's Critical Patch Update for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU patches are cumulative; customers on affected versions (12.2.3-12.2.15) should apply the July 2026 CPU to resolve this issue. If immediate patching is not feasible, restrict network-level access to the EBS application tier so that only trusted internal networks or VPN-authenticated users can reach the HTTP endpoints - this raises the effective attack barrier by requiring prior network-level access before exploitation is possible. Additionally, audit and reduce the number of active low-privileged EBS accounts to minimize the pool of credentials that could be leveraged; disable or lock accounts for inactive users. Note that network restriction does not eliminate the vulnerability for insider scenarios and is only a compensating control. No exact patched version number beyond 'July 2026 CPU' was identified in the available source data.