CVE-2026-61283

Received Received - Intake

Oracle E-Business Suite Bills of Material Data Access Vulnerability

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Oracle

Description

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Web Services). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Bills of Material accessible data as well as unauthorized read access to a subset of Oracle Bills of Material accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Bills of Material. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-61283

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	bills_of_material	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Bills of Material within Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15. A low-privileged attacker with network access can exploit it via HTTP to compromise the Bills of Material component. Successful exploitation allows unauthorized data access and modification, as well as partial denial of service.

Detection Guidance

Detection requires checking for Oracle E-Business Suite versions 12.2.3 to 12.2.15 with the Bills of Material component exposed via HTTP. Inspect Oracle application logs for unusual access patterns or unauthorized data modifications. Use network scanning tools to identify Oracle HTTP services running on affected versions.

Impact Analysis

An attacker could read, modify, or delete some data in Oracle Bills of Material. They might also disrupt service availability for this component. The impact is limited to data and operations within this specific Oracle product.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, which may violate GDPR (data protection) or HIPAA (health data privacy) requirements. Organizations using affected Oracle versions should assess potential compliance risks and apply patches promptly.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update for E-Business Suite immediately. Restrict network access to the Bills of Material component via HTTP using firewalls or access controls. Upgrade to a non-vulnerable version if possible. Monitor for signs of exploitation in logs.

Hi! I’m here to help you understand CVE-2026-61283. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70