EUVD-2026-61681
GHSA-m6f8-fwhj-jmjx
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Local-only exploitation and mandatory high privileges reflect infrastructure-level access dependency; no availability impact applies given data exposure and manipulation are the sole confirmed outcomes.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Cash Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Cash Management executes to compromise Oracle Cash Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Cash Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Cash Management accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Unauthorized data access and modification in Oracle Cash Management (versions 12.2.3 through 12.2.15) is achievable by a high-privileged attacker with local logon access to the host infrastructure where the application executes. Exploitation allows complete read access and write or delete control over critical Cash Management data, covering both confidentiality and integrity at a High impact level with no availability component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold local logon access to the specific infrastructure host where Oracle Cash Management is executing - confirmed by the CVSS AV:L metric, which explicitly rules out any remote or network-based exploitation path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.0 reflects a constrained but meaningful risk profile: the local attack vector and high privilege requirement substantially limit the exploitable population compared to network-accessible vulnerabilities, restricting realistic attackers to insiders, compromised privileged accounts, or post-compromise lateral movement scenarios. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's Critical Security Patch Update for August 2026, documented at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cash Management
View allSame weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today