CVE-2026-61060

Received Received - Intake

Oracle E-Business Suite Secure Enterprise Search SQL Injection

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Oracle

Description

Vulnerability in the Oracle E-Business Suite Secure Enterprise Search product of Oracle E-Business Suite (component: Search Integration Engine). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Secure Enterprise Search. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle E-Business Suite Secure Enterprise Search accessible data as well as unauthorized read access to a subset of Oracle E-Business Suite Secure Enterprise Search accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-61060

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	e-business_suite_secure_enterprise_search	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle E-Business Suite Secure Enterprise Search affecting versions 12.2.3 to 12.2.15. It allows low-privileged attackers with network access to read or modify some data within the Search Integration Engine component. The vulnerability has a CVSS score of 5.4, indicating moderate risk with impacts on confidentiality and integrity.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive data, including the ability to read or alter information stored in Oracle E-Business Suite Secure Enterprise Search. This may lead to data breaches, unauthorized modifications, or data leaks depending on the exposed data.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected versions must address this to maintain data protection and regulatory compliance.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite Secure Enterprise Search versions 12.2.3-12.2.15. Ensure the product is updated to a non-vulnerable version. Restrict network access to HTTP ports used by the Search Integration Engine component. Review and enforce least-privilege access controls for users interacting with the system.

Hi! I’m here to help you understand CVE-2026-61060. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70