What is the CVSS score of EUVD-2026-47484?

EUVD-2026-47484 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Advanced Benefits are affected by EUVD-2026-47484?

Oracle Advanced Benefits 12.2.15 (E-Business Suite) contains a data integrity vulnerability allowing authenticated users with low system privileges to create, delete, or modify critical payroll and…

How to fix or mitigate EUVD-2026-47484?

Within 24 hours, identify and document all E-Business Suite 12.2.15 systems with Advanced Benefits, restrict module access to designated administrators only, and capture current access logs for investigation. Within 7 days, enable enhanced audit logging on data create/delete/modify operations in the Internal Operations component, perform role-based access control review to enforce least privilege, and contact Oracle for patch availability timeline. Within 30 days, implement compensating controls including network segmentation of the module, continuous data integrity validation against authoritative sources, and enhanced monitoring for suspicious modification patterns; maintain readiness for rapid deployment when vendor patch becomes available.

Oracle Advanced Benefits EUVD-2026-47484

| CVE-2026-61324 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-qx2w-3x89-765p

Authentication Bypass Oracle Advanced Benefits

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

vuln.today AI

7.7 HIGH

Network HTTP reachable with low complexity; a valid low-privilege EBS account is required (PR:L, not a bypass), integrity-only impact with a scope change to other products.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:54 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). The supported version that is affected is 12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Benefits. While the vulnerability is in Oracle Advanced Benefits, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Advanced Benefits accessible data. CVSS 3.1 Base Score 7.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N).

AnalysisAI

Unauthorized data manipulation in Oracle Advanced Benefits 12.2.15 (Oracle E-Business Suite, Internal Operations component) lets a low-privileged attacker with HTTP network access create, delete, or modify critical data. Because the CVSS vector carries a scope change (S:C), successful attacks can significantly impact additional products beyond Advanced Benefits itself. The flaw is rated CVSS 3.1 7.7 with integrity-only impact (I:H, C:N, A:N); no public exploit is identified at time of analysis, and it was disclosed via Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Advanced Benefits is a Human Capital Management module within Oracle E-Business Suite (EBS), a large web-based enterprise ERP/HR platform typically fronted by Oracle HTTP Server/Application Server and an Oracle database backend. The affected 'Internal Operations' component is reachable over HTTP, consistent with the AV:N vector. Oracle did not assign a CWE (CWE: N/A), but the integrity-only impact combined with the reporter-supplied 'Authentication Bypass' tag suggests an access-control or authorization weakness (broadly CWE-284/CWE-285 class) allowing a low-privileged session to perform actions on data it should not reach. The scope change (S:C) indicates the vulnerable component can affect resources managed by other EBS products or the underlying platform.

RemediationAI

Apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor advisory addressing this issue for Oracle Advanced Benefits 12.2.15 - treat this as Patch available per vendor advisory, as the input does not enumerate an exact post-patch build number. Because Oracle EBS CPUs are cumulative, install the corresponding EBS 12.2 patch bundle for July 2026 as prescribed by Oracle. As compensating controls until patching, restrict network access to the EBS Internal Operations/Advanced Benefits endpoints to trusted internal networks or VPN only, tighten authorization so low-privilege accounts cannot reach Advanced Benefits functions, and increase auditing/monitoring of create/delete/modify operations on benefits data; the trade-off is that access restrictions may disrupt legitimate self-service HR/benefits users and require careful role review before enforcement.