CVE-2026-61309
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Vulnerability in Oracle In-Memory Cost Management for Discrete Industries product of Oracle E-Business Suite, component Internal Operations. Affects versions 12.2.3-12.2.15. An unauthenticated attacker can remotely access critical data or all data in the system via HTTP.
Risk Assessment
Risk of exposure of sensitive cost and operational data, potentially affecting competitive advantage and business decisions.
Recommendation
Apply the patch provided by Oracle in the Critical Patch Update (CPU) for Oracle E-Business Suite immediately.
Other vulnerabilities in Oracle E-Business Suite
See all- CVE-2026-62549Critical
Vulnerability in Oracle HRMS (UK) (component: UK Payroll) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise the system, leading to unauthorized creation, deletion, or modification of critical data and access to all Oracle HRMS (UK) data. Scope change impacts additional products.
- CVE-2026-46817CriticalActively exploited
Critical vulnerability in Oracle Payments (Oracle E-Business Suite) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can fully compromise the system without any privileges.
- CVE-2025-62481Critical
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration) affecting versions 12.2.3-12.2.14. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing (CVSS 9.8).
- CVE-2025-53072Critical
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration) affecting versions 12.2.3-12.2.14. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing (CVSS 9.8).
- CVE-2026-83428High
Vulnerability in Oracle Demand Signal Repository (Oracle E-Business Suite), component Internal Operations, affecting versions 12.2.3-12.2.15. A low-privileged authenticated attacker with HTTP network access can gain unauthorized access to data and create, delete, or modify data. CVSS 3.1 Base Score 8.1.
- CVE-2026-83425High
Vulnerability in Oracle Complex Maintenance, Repair and Overhaul (Oracle E-Business Suite), component Internal Operations, affecting versions 12.2.12-12.2.15. A low-privileged authenticated attacker with HTTP network access can access critical data and cause a partial denial of service. CVSS 3.1 Base Score 8.5.
- CVE-2026-83205High
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization) affecting versions 12.2.3-12.2.15. Easily exploitable by a low privileged attacker with network access via HTTP. Successful attacks can result in takeover of the component.
- CVE-2026-83204High
Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3-12.2.15. Difficult to exploit, but allows a low privileged attacker with network access via HTTP to take over the product.
- CVE-2026-83159High
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: ADPatch) affecting versions 12.2.3-12.2.15. An authenticated attacker with local logon can exploit it if another person performs a specific action, leading to takeover of Applications DBA.
- CVE-2026-83158High
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone) affecting versions 12.2.3-12.2.15. A low-privileged attacker with local logon can gain unauthorized access to critical data and create, delete, or modify data.
Original NVD description (English source)
Vulnerability in the Oracle In-Memory Cost Management for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle In-Memory Cost Management for Discrete Industries. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle In-Memory Cost Management for Discrete Industries accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS