CVE-2026-61198
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Vulnerability in Oracle Learning Management (component: Internal Operations) affects versions 12.2.3-12.2.15. It is easily exploitable by an unauthenticated attacker via HTTP, allowing unauthorized update, insert, or delete access to some data and read access to a subset of data.
Risk Assessment
Risk of integrity and confidentiality breach in Oracle Learning Management, potentially leading to unauthorized modifications and information disclosure.
Recommendation
Apply Oracle patches for versions 12.2.3-12.2.15 and restrict network access to the system if possible.
Other vulnerabilities in Oracle Learning Management
See all- CVE-2026-60948High
Vulnerability in Oracle Learning Management (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can easily gain unauthorized access to critical data and the ability to create, delete, or modify it.
- CVE-2026-60945High
Vulnerability in Oracle Learning Management (E-Business Suite). Low-privileged attacker via HTTP can compromise data confidentiality and integrity, requiring user interaction.
Original NVD description (English source)
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Learning Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Learning Management accessible data as well as unauthorized read access to a subset of Oracle Learning Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS