CVE-2026-61023
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Vulnerability in Oracle Inventory Management (Internal Operations component) versions 12.2.3-12.2.15. A high-privileged attacker with local access can exploit this vulnerability, potentially leading to takeover of Oracle Inventory Management.
Risk Assessment
The risk involves potential full compromise of the inventory management system, which could disrupt business operations and compromise confidentiality, integrity, and availability of data.
Recommendation
Immediately apply patches provided by Oracle for versions 12.2.3-12.2.15 and restrict local access to servers to trusted high-privileged administrators only.
Other vulnerabilities in Oracle Inventory Management
See all- CVE-2026-61028Low
Vulnerability in Oracle Inventory Management (versions 12.2.3-12.2.15) allows a high-privileged attacker with local logon to cause a partial denial of service.
- CVE-2026-61014High
Vulnerability in Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations). Affected versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can easily exploit this, leading to unauthorized access to critical data or full access to all Oracle Inventory Management data. Attacks may impact additional products (scope change). CVSS 7.7 (Confidentiality).
- CVE-2026-60917High
Vulnerability in Oracle Inventory Management (Core Receiving component) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and modify it.
Original NVD description (English source)
Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Inventory Management executes to compromise Oracle Inventory Management. Successful attacks of this vulnerability can result in takeover of Oracle Inventory Management. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).