What is the CVSS score of EUVD-2026-47491?

EUVD-2026-47491 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Product Workbench are affected by EUVD-2026-47491?

Oracle E-Business Suite versions 12.2.3-12.2.15 contain a high-severity vulnerability (CVSS 8.1) in the Product Workbench module enabling unauthorized access to read and modify sensitive business…

How to fix or mitigate EUVD-2026-47491?

Within 24 hours, identify and inventory all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 and assess which systems access critical business data through Product Workbench. Within 7 days, implement network segmentation and firewall rules restricting HTTP access to affected Oracle EBS instances to only authorized internal hosts; enforce principle-of-least-privilege access controls within the application; and enable enhanced logging of all data access and modification activities. Within 30 days, develop and execute an upgrade plan to migrate to Oracle E-Business Suite 12.2.16 or later, monitor Oracle Security Advisories for patch announcements, and evaluate Web Application Firewall rules to provide additional protection pending upgrade completion.

Oracle Product Workbench EUVD-2026-47491

| CVE-2026-61335 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-wjfj-q85m-x55v

Authentication Bypass Oracle Product Workbench

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

HTTP-reachable so AV:N/AC:L, but a valid low-privilege EBS account is required so PR:L; high data read and write impact gives C:H/I:H, with no availability effect (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:51 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Workbench. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Workbench accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Workbench accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized read and write access to critical data in Oracle Product Workbench (Internal Operations component of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to create, delete, or modify all data accessible to the application. The flaw is rated CVSS 8.1 with high confidentiality and integrity impact but no availability impact, was reported by Oracle's own security team in the July 2026 Critical Patch Update, and is tagged as an authentication-bypass-class issue. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Product Workbench is a module within Oracle E-Business Suite (EBS), Oracle's on-premises ERP/CRM/SCM application suite, and the affected surface is the 'Internal Operations' component. EBS 12.2.x runs on the Oracle Application Framework (OAF) over WebLogic/Oracle HTTP Server and is reached via HTTP web endpoints, which is consistent with the AV:N (network/HTTP) vector. Because PR:L is required, the attacker must already hold a valid low-privilege application account, and the 'Authentication Bypass' tag combined with C:H/I:H suggests a missing authorization/access-control check that lets an authenticated low-privilege user reach data or operations beyond their intended scope. Oracle does not publish a CWE for CPU advisories (CWE is N/A here), but the behavior aligns with the broken-access-control / improper-authorization class (e.g., CWE-285/CWE-862).

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update - Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html; no discrete fixed EBS point-release version was included in the provided data, so consult the CPU patch matrix for the exact patch number matching your 12.2.x level and do not rely on an assumed version. Oracle strongly recommends applying CPU patches promptly and keeping EBS on a supported 12.2 patch level. As compensating controls until patched: restrict network reachability of the Product Workbench / Internal Operations endpoints to trusted internal networks or VPN rather than exposing them to the broader network, tighten EBS application role/responsibility assignments so low-privilege accounts cannot reach Product Workbench functions (trade-off: may block legitimate users who need the module), enforce least privilege and review recently granted low-privilege accounts, and monitor application and web logs for anomalous create/delete/modify activity against Product Workbench data. These controls reduce exposure but are not a substitute for the CPU patch.