CVE-2026-61101
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in Oracle MES for Process Manufacturing (Internal Operations component) versions 12.2.3-12.2.15. Easily exploitable, requires network access via HTTP and user interaction. Successful attack can lead to unauthorized access to critical data and data modification. CVSS 8.2.
Risk Assessment
The risk is unauthorized read and modification of data in Oracle MES for Process Manufacturing by an unauthenticated attacker, potentially compromising confidentiality and integrity of production data.
Recommendation
Apply patches provided by Oracle in the Critical Patch Update (CPU). Also educate users to avoid clicking suspicious links.
Other vulnerabilities in Oracle MES for Process Manufacturing
See all- CVE-2026-70827High
Vulnerability in Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Affects versions 12.2.3-12.2.15. A low-privileged attacker can gain full access to data via HTTP, and attacks may impact additional products (scope change).
- CVE-2026-61340High
Vulnerability in Oracle MES for Process Manufacturing (component: Internal Operations) in versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can compromise the system, but user interaction is required. The attack may impact other products (scope change) and lead to unauthorized access to critical data and modification of some data.
Original NVD description (English source)
Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle MES for Process Manufacturing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle MES for Process Manufacturing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle MES for Process Manufacturing accessible data as well as unauthorized update, insert or delete access to some of Oracle MES for Process Manufacturing accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).