EUVD-2026-61761
GHSA-q7w7-x255-52rp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated HTTP access with no complexity barrier yields high confidentiality impact only; no integrity or availability effect described.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Scripting accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthenticated remote data disclosure in Oracle Scripting (Oracle E-Business Suite component: Internal Operations) affects all supported releases from 12.2.3 through 12.2.15. Exploitation over HTTP requires no credentials, no user interaction, and no special configuration - consistent with the Authentication Bypass tag reported alongside this vulnerability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special configuration is required - the vulnerability affects Oracle Scripting in its supported default deployment state across versions 12.2.3 through 12.2.15. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 High score is well-supported by the underlying vector: AV:N/AC:L/PR:N/UI:N places this in the highest exploitability tier - no authentication, no complexity, no user interaction, and direct HTTP access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Patch Update (CPU) released August 2026, available via the Oracle Security Alerts portal at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15 and immediately implement network-level access controls restricting HTTP/HTTPS connections to Oracle Scripting to authorized users only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today