What is the CVSS score of EUVD-2026-47462?

EUVD-2026-47462 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Advanced Benefits EUVD-2026-47462

| CVE-2026-61282 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-596q-8pcm-9rwm

Authentication Bypass Denial Of Service Oracle Advanced Benefits

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Vendor-provided vector is well-supported by the description: network HTTP access, low complexity, low privilege required, no UI, no scope change, and partial C/I/A impacts.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:05 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Self Service Benefits). Supported versions that are affected are 12.2.4-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Benefits. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Advanced Benefits accessible data as well as unauthorized read access to a subset of Oracle Advanced Benefits accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Advanced Benefits. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Partial compromise of Oracle Advanced Benefits (Self Service Benefits component) is achievable by any low-privileged, network-adjacent attacker over HTTP, affecting all E-Business Suite deployments on versions 12.2.4 through 12.2.15. Successful exploitation yields unauthorized read access to a subset of benefits data, unauthorized write/insert/delete capability against accessible records, and the ability to cause partial denial of service within the affected component. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog, though the low complexity and minimal privilege threshold make it accessible to a broad pool of internal threat actors.

Technical ContextAI

Oracle Advanced Benefits is a module within Oracle E-Business Suite (EBS), Oracle's flagship on-premises enterprise resource planning platform. The Self Service Benefits component provides a web-based interface - accessible over HTTP - through which employees and HR staff manage benefit elections, enrollments, and related records. The affected version range, 12.2.4 through 12.2.15, spans multiple years of EBS 12.2 maintenance releases. No CWE has been assigned by Oracle or NVD, so the precise root-cause class (e.g., broken access control, improper authorization, SQL injection, or IDOR) is unconfirmed from available data. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) is consistent with a server-side flaw in the application tier that can be triggered by any authenticated session without special conditions, suggesting an authorization or input-handling weakness rather than a memory-corruption class vulnerability.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available via My Oracle Support, which addresses this vulnerability for Oracle E-Business Suite 12.2. Oracle does not publicly disclose exact patch version numbers outside of MOS; customers should reference the July 2026 CPU advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the applicable patch identifiers and installation instructions. If immediate patching is not feasible, compensating controls should target the PR:L prerequisite: restrict EBS Self Service Benefits HTTP access to known, trusted network segments or VPN-only; enforce the principle of least privilege by revoking Self Service Benefits access for users who do not require it; and enable EBS audit logging for the Benefits module to detect anomalous read or write patterns. Note that network-layer restrictions do not eliminate the vulnerability - they reduce the attacker pool to those already on trusted segments. Full remediation requires the Oracle-issued patch.