What is the CVSS score of EUVD-2026-47492?

EUVD-2026-47492 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Lease Finance Management are affected by EUVD-2026-47492?

Versions 12.2.14-12.2.15 of Oracle Lease and Finance Management face a critical vulnerability that allows privileged insiders to completely compromise the system and manipulate financial data.

How to fix or mitigate EUVD-2026-47492?

Within 24 hours: Identify all systems running Oracle E-Business Suite versions 12.2.14 and 12.2.15; audit and document users with high application privileges to the Lease and Finance Management module; implement network segmentation or access controls to restrict unauthorized usage. Within 7 days: Deploy audit logging and monitoring for authentication, transactions, and configuration changes in the module; contact Oracle Support to request security updates and patch availability timeline; preserve logs for forensic review. Within 30 days: Apply the vendor patch immediately upon availability; if no near-term patch is expected, plan and execute an upgrade to a supported Oracle E-Business Suite version; conduct a forensic review of all activities during the vulnerability period.

Oracle Lease Finance Management EUVD-2026-47492

| CVE-2026-61336 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-pgmm-7f4r-87jh

Privilege Escalation Oracle Lease And Finance Management

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Reachable over HTTP (AV:N) with low complexity, but requires high application privileges (PR:H); full takeover yields C:H/I:H/A:H with scope unchanged.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:50 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.14-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Lease and Finance Management. Successful attacks of this vulnerability can result in takeover of Oracle Lease and Finance Management. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Lease and Finance Management (versions 12.2.14 through 12.2.15), a module of Oracle E-Business Suite's Internal Operations component, is possible for a network-based attacker who already holds high application privileges. Oracle rates this CVSS 3.1 7.2 with high confidentiality, integrity, and availability impact, describing successful attacks as resulting in complete takeover of the module. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the modest EPSS-relevant profile is consistent with the high-privilege precondition limiting mass exploitation.

Technical ContextAI

Oracle Lease and Finance Management (OLFM) is a specialized ERP module within Oracle E-Business Suite (EBS), the 12.2.x application server stack that delivers business functionality over HTTP via Oracle Application Server / WebLogic and a shared EBS schema. The flaw sits in the Internal Operations component of OLFM and is reached through HTTP, meaning it lives in the web-exposed application tier rather than the database engine directly. No CWE was assigned by Oracle (CWE: N/A) and the advisory is a bundled Critical Patch Update entry, so the precise weakness class (e.g., injection, access-control, or deserialization) is not published; the S:U (scope unchanged) rating indicates the impact is contained to the OLFM/EBS security authority rather than crossing into the underlying OS or other components.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor's authoritative source for the exact patch bundle covering EBS 12.2.14-12.2.15; Patch available per vendor advisory, but no discrete fixed sub-version string is provided in the input, so obtain the specific EBS/OLFM patch number directly from the CPU matrix. Because exploitation requires high application privileges, the most effective compensating controls are to audit and minimize accounts holding privileged OLFM/Internal Operations roles, enforce strong authentication and session controls on those accounts, and restrict HTTP access to the EBS application tier to trusted internal networks or VPN (trade-off: may disrupt remote or partner integrations that legitimately reach OLFM). Monitor OLFM transaction and admin logs for anomalous privileged activity as an interim detective control until the CPU patch is deployed.