PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-61328 Oracle Corporation CVE debrief

A vulnerability was discovered in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. This difficult-to-exploit vulnerability allows a high-privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in the takeover of Oracle Cost Management. The vulnerability has a medium severity level with a CVSS 3.1 Base Score of 6.6.

Vendor
Oracle Corporation
Product
Oracle Cost Management
CVSS
MEDIUM 6.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

Administrators and users of Oracle E-Business Suite, particularly those with high privileges, should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes applying patches or updates provided by Oracle, restricting network access, and implementing additional security controls.

Technical summary

The vulnerability has a CVSS 3.1 Base Score of 6.6, indicating a medium severity level. The CVSS Vector is (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), which means the vulnerability can be exploited over the network with high privileges, and successful attacks can lead to high impacts on confidentiality, integrity, and availability. This vulnerability affects the Oracle Cost Management product of Oracle E-Business Suite, specifically the Cost Planning component in versions 12.2.3-12.2.15.

Defensive priority

High priority should be given to patching or mitigating this vulnerability, as it can lead to significant impacts if exploited.

Recommended defensive actions

  • Apply the patch or update provided by Oracle to fix the vulnerability.
  • Restrict network access to the Oracle Cost Management system to minimize the attack surface.
  • Monitor system logs and network traffic for suspicious activities.
  • Implement additional security controls, such as multi-factor authentication and role-based access control.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-21T22:19:01.127Z and was last modified on 2026-07-22T18:17:02.910Z. The NVD entry is currently in the 'Received' status. This information is based on the supplied source corpus and may not reflect the current status of the vulnerability. Defenders should verify the current status and affected scope with the vendor or through other reliable sources.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:19:01.127Z and has not been modified since then. The NVD entry is currently in the 'Received' status.