What is the CVSS score of EUVD-2026-61581?

EUVD-2026-61581 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Trading Community are affected by EUVD-2026-61581?

Oracle Trading Community (E-Business Suite versions 12.2.3-12.2.15) contains an unauthenticated remote data exposure vulnerability enabling attackers to read all trading records from the network…

How to fix or mitigate EUVD-2026-61581?

Within 24 hours, inventory all Oracle E-Business Suite instances to identify systems running versions 12.2.3 through 12.2.15 with Third Party Data Integration enabled; simultaneously restrict HTTP access to the Trading Community component via firewall rules, limiting connections to trusted internal networks only, and enable comprehensive logging of all requests to the affected module. Within 7 days, evaluate whether the Third Party Data Integration component can be disabled without business impact; if it must remain enabled, deploy Web Application Firewall rules with data exfiltration prevention and establish automated alerting for suspicious data access patterns and large exports. Within 30 days, monitor Oracle Security Advisories weekly for patch availability and immediately test any released patches in non-production environments; implement network segmentation to isolate E-Business Suite infrastructure from untrusted networks; conduct a full data access audit to identify what sensitive trading information may have been exposed, and notify affected parties per compliance and legal requirements.

Oracle Trading Community EUVD-2026-61581

| CVE-2026-62599 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-q88w-j5x6-f6xg

Authentication Bypass Oracle Trading Community

8.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Network HTTP access, no credentials required per authentication bypass, scope change to other EBS modules, confidentiality impact only with no integrity or availability effects.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 23:35 vuln.today

CVE Published

Aug 18, 2026 - 21:17 nvd

HIGH 8.6

DescriptionCVE.org

Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite (component: Third Party Data Integration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trading Community. While the vulnerability is in Oracle Trading Community, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Trading Community accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthenticated remote data exposure in Oracle Trading Community (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a network attacker to bypass authentication in the Third Party Data Integration component via HTTP, gaining complete read access to all data accessible by Oracle Trading Community. The scope change (S:C) means a successful attack can cascade into other EBS modules or integrated downstream systems. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions are required for exploitation: the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against any network-reachable Oracle E-Business Suite instance running versions 12.2.3 through 12.2.15 with the Third Party Data Integration component active. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N yields a base score of 8.6 (High), and all four exploitability metrics are at their worst values: network-reachable, low complexity, no privileges required, no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's August 2026 Critical Patch Update (CPU), available via the advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Oracle E-Business Suite instances to identify systems running versions 12.2.3 through 12.2.15 with Third Party Data Integration enabled; simultaneously restrict HTTP access to the Trading Community component via firewall rules, limiting connections to trusted internal networks only, and enable comprehensive logging of all requests to the affected module. …

Threat intelligence, references, and detailed analysis are available after sign-in.