CVE-2026-61277: Medium severity Oracle Oracle E-Business Suite (Oracle Marketing) vulnerability
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Marketing accessible data as well as unauthorized read access to a subset of Oracle Marketing accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Marketing. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle E-Business Suite - Oracle Marketing (component: Audience)to a version that resolves this vulnerability.Fixed in 12.2.3-12.2.15
Event History
Frequently Asked Questions
Which deployments are affected?
Affected supported versions are Oracle E-Business Suite Oracle Marketing, component Audience, from 12.2.3 through 12.2.15.
What access does an attacker need to exploit this issue?
An attacker needs network access over HTTP and low-privileged access. No user interaction is required, and the attack complexity is low.
What could exploitation allow?
Successful exploitation can allow unauthorized reading of a subset of accessible Oracle Marketing data, unauthorized updates, inserts, or deletions of some accessible data, and partial denial of service of Oracle Marketing.