CVE-2026-61292
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In Oracle U.S. Federal Financials (part of Oracle E-Business Suite) versions 12.2.3-12.2.15, there is an easily exploitable vulnerability. A low-privileged attacker with network access via HTTP can gain unauthorized read access to a subset of data.
Risk Assessment
The organization may be at risk of financial data leakage from Oracle U.S. Federal Financials, potentially compromising information confidentiality.
Recommendation
Apply patches provided by Oracle in the Critical Patch Update program. Restrict network access to the system.
Other vulnerabilities in Oracle U.S. Federal Financials
See all- CVE-2026-61319High
Vulnerability in Oracle U.S. Federal Financials (component: Internal Operations) in versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can fully take over the system. No user interaction is required.
- CVE-2026-60686High
Vulnerability in Oracle U.S. Federal Financials product of Oracle E-Business Suite (component: Internal Operations). Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise data confidentiality and integrity.
Original NVD description (English source)
Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle U.S. Federal Financials. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle U.S. Federal Financials accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).