CVE-2026-61320
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Vulnerability in Oracle Payables (Oracle E-Business Suite) component Internal Operations. Versions 12.2.8-12.2.15 are affected. A low-privileged attacker with network access via HTTP can compromise Oracle Payables.
Risk Assessment
Successful attack can lead to full takeover of Oracle Payables, resulting in loss of confidentiality, integrity, and availability.
Recommendation
Apply the patch provided by Oracle for Oracle E-Business Suite in the appropriate version.
Other vulnerabilities in Oracle Payables
See all- CVE-2026-70701High
Vulnerability in Oracle Payables (component: Internal Operations) versions 12.2.3-12.2.15. A low-privileged attacker can gain unauthorized access to critical data and modify or delete it via HTTP.
- CVE-2026-70700High
Vulnerability in Oracle Payables (component: Internal Operations) versions 12.2.3-12.2.15. An unauthenticated attacker can cause a hang or frequent crashes (full DoS) of Oracle Payables via HTTP.
Original NVD description (English source)
Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payables. Successful attacks of this vulnerability can result in takeover of Oracle Payables. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).