CVE-2026-61324

Received Received - Intake

Oracle Advanced Benefits Data Integrity Flaw

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Oracle

Description

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). The supported version that is affected is 12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Benefits. While the vulnerability is in Oracle Advanced Benefits, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Advanced Benefits accessible data. CVSS 3.1 Base Score 7.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-61324

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	advanced_benefits	12.2.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Advanced Benefits within Oracle E-Business Suite version 12.2.15. It allows a low-privileged attacker with network access to exploit it via HTTP. The flaw enables unauthorized creation, deletion, or modification of critical data or all accessible data in Oracle Advanced Benefits.

Impact Analysis

An attacker could alter or delete sensitive employee benefit data, leading to financial or operational disruptions. Since the vulnerability may impact additional products, the effects could extend beyond Oracle Advanced Benefits.

Compliance Impact

This vulnerability could lead to unauthorized data modification or deletion, violating integrity requirements in GDPR and HIPAA. Non-compliance risks include fines, legal penalties, and reputational damage due to compromised data integrity.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite version 12.2.15 to address the vulnerability in Oracle Advanced Benefits. Ensure network access controls restrict HTTP access to only trusted sources and review user privileges to limit low-privileged accounts.

Hi! I’m here to help you understand CVE-2026-61324. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70