CVE-2026-61340
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Vulnerability in Oracle MES for Process Manufacturing (component: Internal Operations) in versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can compromise the system, but user interaction is required. The attack may impact other products (scope change) and lead to unauthorized access to critical data and modification of some data.
Risk Assessment
Risk includes breach of confidentiality and integrity, including full access to Oracle MES data and unauthorized modification. High CVSS score 8.2 indicates serious threat to the organization.
Recommendation
Apply Oracle patches for versions 12.2.3-12.2.15. Restrict network access to the system and educate users about risks of interacting with unknown content.
Other vulnerabilities in Oracle MES for Process Manufacturing
See all- CVE-2026-70827High
Vulnerability in Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Affects versions 12.2.3-12.2.15. A low-privileged attacker can gain full access to data via HTTP, and attacks may impact additional products (scope change).
- CVE-2026-61101High
A vulnerability in Oracle MES for Process Manufacturing (Internal Operations component) versions 12.2.3-12.2.15. Easily exploitable, requires network access via HTTP and user interaction. Successful attack can lead to unauthorized access to critical data and data modification. CVSS 8.2.
Original NVD description (English source)
Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle MES for Process Manufacturing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle MES for Process Manufacturing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle MES for Process Manufacturing accessible data as well as unauthorized update, insert or delete access to some of Oracle MES for Process Manufacturing accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS