CVE-2026-61049

Analyzed Analyzed - Analysis Complete

Unauthenticated Access in Oracle Production Scheduling

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description

Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Production Scheduling executes to compromise Oracle Production Scheduling. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Production Scheduling. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-61049

EUVD

EUVD-2026-47263

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	production_scheduling	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-640	The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Production Scheduling within Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15. The issue allows an unauthenticated attacker with access to the physical network segment where the software runs to potentially take over the system. Exploitation requires human interaction from someone other than the attacker.

Detection Guidance

Detection of this vulnerability requires monitoring for unauthorized access to the Oracle Production Scheduling component within Oracle E-Business Suite. Check network traffic for unusual communication patterns to the affected product versions (12.2.3-12.2.15). Inspect logs for suspicious activity involving the physical communication segment attached to the hardware running Oracle Production Scheduling.

Impact Analysis

If exploited, this vulnerability could allow an attacker to fully compromise Oracle Production Scheduling, leading to loss of confidentiality, integrity, and availability of the system. This could disrupt production scheduling operations and potentially lead to unauthorized access or control of critical business processes.

Compliance Impact

This vulnerability could lead to unauthorized access and control of Oracle Production Scheduling, potentially exposing sensitive data. This may impact compliance with GDPR and HIPAA by risking data confidentiality, integrity, and availability.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Production Scheduling immediately. Restrict physical and network access to the hardware running Oracle Production Scheduling to authorized personnel only. Monitor and audit all access to the system for unusual activity.

Hi! I’m here to help you understand CVE-2026-61049. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70