PatchSiren cyber security CVE debrief

CVE-2026-61283 Oracle Corporation CVE debrief

A vulnerability was discovered in Oracle Bills of Material, a product of Oracle E-Business Suite. The vulnerability is related to the Web Services component and affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can exploit this vulnerability, potentially leading to unauthorized data access and partial denial of service. This vulnerability has a CVSS 3.1 Base Score of 6.3, indicating a medium severity level.

Vendor: Oracle Corporation
Product: Oracle Bills of Material
CVSS: MEDIUM 6.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-21
Original CVE updated: 2026-07-22
Advisory published: 2026-07-21
Advisory updated: 2026-07-22

Who should care

Organizations using Oracle Bills of Material versions 12.2.3-12.2.15 should prioritize patching this vulnerability to prevent potential data breaches and service disruptions. This is crucial for operators, platform administrators, vulnerability management teams, and security teams to ensure the security and integrity of their systems.

Technical summary

The vulnerability in Oracle Bills of Material has a CVSS 3.1 Base Score of 6.3, indicating a medium severity level. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), showing that the vulnerability allows for low-privileged attacks over the network with low complexity. Successful exploitation can lead to unauthorized update, insert, or delete access to some accessible data, unauthorized read access to a subset of accessible data, and partial denial of service.

Defensive priority

Medium priority should be given to patching this vulnerability, as it can be exploited by low-privileged attackers over the network.

Recommended defensive actions

Apply the latest security patches for Oracle Bills of Material
Conduct a thorough inventory of affected systems
Implement compensating controls to monitor and restrict access
Review and update network access controls
Monitor for suspicious activity related to Oracle Bills of Material
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record was published on 2026-07-21T22:18:58.417Z and modified on 2026-07-22T15:17:20.603Z. The NVD entry is currently in the 'Received' status. Oracle has provided a security alert for this vulnerability (source reference: [email protected]). The vulnerability affects versions 12.2.3-12.2.15 of Oracle Bills of Material. Defenders should verify the affected scope and severity based on the official advisory.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:58.417Z and has not been modified since then. The NVD entry is currently Received.