CVE-2026-61044: Medium severity Oracle Oracle E-Business Suite - Oracle Production Scheduling vulnerability
Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Production Scheduling. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Production Scheduling accessible data as well as unauthorized read access to a subset of Oracle Production Scheduling accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Production Scheduling. CVSS 3.1 Base Score 4.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker needs high privileges and network access to the affected Oracle Production Scheduling component over HTTP. No user interaction is required, and the attack complexity is low.
Which supported versions are affected?
Affected supported versions are Oracle Production Scheduling 12.2.3 through 12.2.15. The provided information does not identify any unaffected version within that range.
What could an attacker do after successful exploitation?
Successful exploitation can allow unauthorized reading of a subset of accessible data, unauthorized updates, inserts, or deletions of some accessible data, and partial denial of service against Oracle Production Scheduling.