CVE-2026-61107
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Vulnerability in Oracle Applications DBA (Oracle E-Business Suite) allows a high-privileged attacker with network access via HTTP to take over the system. Affects versions 12.2.3-12.2.15.
Risk Assessment
Successful attack can lead to full takeover of Oracle Applications DBA, risking confidentiality, integrity, and availability of data.
Recommendation
Apply patches provided by Oracle for versions 12.2.3-12.2.15 immediately.
Other vulnerabilities in Oracle Applications DBA
See all- CVE-2026-70681High
Vulnerability in Oracle Applications DBA (component: JRI and other Java utilities) affects versions 12.2.3-12.2.15. It is difficult to exploit, requires user interaction, but allows an unauthenticated attacker via HTTP to take over the application.
- CVE-2026-70680High
Vulnerability in Oracle Applications DBA (component: Internal Operations) affects versions 12.2.3-12.2.15. It is easily exploitable by a low-privileged attacker via HTTP, allowing unauthorized access to critical data and partial denial of service.
Original NVD description (English source)
Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications DBA. Successful attacks of this vulnerability can result in takeover of Oracle Applications DBA. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).