PatchSiren cyber security CVE debrief

CVE-2026-61279 Oracle Corporation CVE debrief

A vulnerability was discovered in the Oracle Proposals product of Oracle E-Business Suite (component: Proposals). The affected versions are 12.2.3-12.2.15. This vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Proposals. Successful attacks can result in unauthorized update, insert or delete access to some of Oracle Proposals accessible data, unauthorized read access to a subset of Oracle Proposals accessible data, and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Proposals. The vulnerability has a CVSS 3.1 Base Score of 6.3, indicating a medium severity.

Vendor: Oracle Corporation
Product: Oracle Proposals
CVSS: MEDIUM 6.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-21
Original CVE updated: 2026-07-22
Advisory published: 2026-07-21
Advisory updated: 2026-07-22

Who should care

Organizations using Oracle E-Business Suite, specifically versions 12.2.3-12.2.15, should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes reviewing system configurations, monitoring for suspicious activity, and applying patches or mitigations as recommended by Oracle. IT security teams and vulnerability management teams should prioritize this vulnerability for remediation.

Technical summary

The vulnerability has a CVSS 3.1 Base Score of 6.3, indicating a medium severity. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). This means that the vulnerability can be exploited over the network (AV:N), requires low attack complexity (AC:L), and can be exploited by a low-privileged attacker (PR:L). Successful exploitation can lead to unauthorized update, insert or delete access to some of Oracle Proposals accessible data, unauthorized read access to a subset of Oracle Proposals accessible data, and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Proposals.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it can lead to unauthorized data access and partial denial of service.

Recommended defensive actions

Apply the patches provided by Oracle as soon as possible
Restrict network access to the Oracle Proposals component
Monitor for suspicious activity and implement compensating controls
Verify the integrity of Oracle Proposals accessible data
Implement additional security measures to prevent exploitation
Review system configurations and ensure proper security controls are in place
Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-07-21T22:18:58.080Z and was last modified on 2026-07-22T16:18:45.217Z. The NVD entry is currently in the 'Received' status. There may be additional information available from Oracle regarding this vulnerability. Defenders should verify the integrity of Oracle Proposals accessible data and review system logs for potential suspicious activity related to this vulnerability.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:58.080Z and has not been modified since then. The NVD entry is currently Received.