CVE-2026-61311: High severity Oracle Oracle E-Business Suite vulnerability

Q: Which deployments are affected?

Oracle Product Hub in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is affected. The vulnerable component is Internal Operations.

Q: What access does an attacker need?

An attacker needs network access to the affected Product Hub instance over HTTP and low-privileged credentials. No user interaction is required, and the attack complexity is low.

Q: What is the potential impact of successful exploitation?

Successful exploitation can result in takeover of Oracle Product Hub, with high impacts to confidentiality, integrity, and availability.

Published Jul 21, 2026

Updated

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected Software

2 affected components

Oracle Oracle E-Business Suite>=12.2.3<=12.2.15

Oracle Product Hub>=12.2.3<=12.2.15

Event History

Jul 21, 2026

CVE Published

via MITRE·09:39 PM

Data Sourced

via MITRE·09:39 PM

DescriptionSeverity

Data Sourced

via NVD·10:18 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are affected?

Oracle Product Hub in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is affected. The vulnerable component is Internal Operations.

What access does an attacker need?

An attacker needs network access to the affected Product Hub instance over HTTP and low-privileged credentials. No user interaction is required, and the attack complexity is low.

What is the potential impact of successful exploitation?