CVE-2026-61340
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Vulnerability in Oracle MES for Process Manufacturing (component: Internal Operations) in versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can compromise the system, but user interaction is required. The attack may impact other products (scope change) and lead to unauthorized access to critical data and modification of some data.
Risk Assessment
Risk includes breach of confidentiality and integrity, including full access to Oracle MES data and unauthorized modification. High CVSS score 8.2 indicates serious threat to the organization.
Recommendation
Apply Oracle patches for versions 12.2.3-12.2.15. Restrict network access to the system and educate users about risks of interacting with unknown content.
Original NVD description (English source)
Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle MES for Process Manufacturing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle MES for Process Manufacturing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle MES for Process Manufacturing accessible data as well as unauthorized update, insert or delete access to some of Oracle MES for Process Manufacturing accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).