CVE-2026-61110

Analyzed Analyzed - Analysis Complete

Oracle Applications DBA Remote Code Execution

Publication date: 2026-07-21

Last updated on: 2026-08-01

Assigner: Oracle

Description

Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: ADPatch). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications DBA. Successful attacks of this vulnerability can result in takeover of Oracle Applications DBA. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-01

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-61110

EUVD

EUVD-2026-47321

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	applications_dba	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Applications DBA within Oracle E-Business Suite, specifically affecting versions 12.2.3 to 12.2.15. It allows a low-privileged attacker with network access via HTTP to take over the Oracle Applications DBA component. The vulnerability has a high CVSS score of 8.8 due to its impact on confidentiality, integrity, and availability.

Detection Guidance

Detection of this vulnerability requires checking for unpatched versions of Oracle Applications DBA (12.2.3-12.2.15) and verifying if ADPatch components are exposed via HTTP. Oracle recommends reviewing system logs for unauthorized access attempts and ensuring the latest security patches are applied.

Impact Analysis

If exploited, this vulnerability could allow an attacker to fully compromise Oracle Applications DBA, leading to unauthorized access, data breaches, or system disruptions. This could result in loss of sensitive data, unauthorized modifications, or denial of service for critical applications.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to potential data breaches or unauthorized access to sensitive information. Organizations may face legal penalties, reputational damage, and loss of customer trust if such a breach occurs.

Mitigation Strategies

Apply the latest Oracle E-Business Suite patches for the ADPatch component. Restrict network access to HTTP ports for Oracle Applications DBA. Monitor for unauthorized changes or access to the Oracle Applications DBA system.

Hi! I’m here to help you understand CVE-2026-61110. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70