CVE-2026-61320: High severity Oracle Oracle E-Business Suite - Payables (Internal Operations) vulnerability
Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payables. Successful attacks of this vulnerability can result in takeover of Oracle Payables. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle E-Business Suite - Oracle Payables (Internal Operations)to a version that resolves this vulnerability.Fixed in 12.2.8-12.2.15
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61320?
The severity of CVE-2026-61320 is high with a CVSS score of 8.8.
What is CVE-2026-61320?
CVE-2026-61320 is a vulnerability in the Oracle Payables component of the Oracle E-Business Suite that allows low privileged attackers to exploit the system.
How do I fix CVE-2026-61320?
To fix CVE-2026-61320, update your Oracle E-Business Suite to a version not affected, specifically 12.2.16 or later.
What are the affected versions by CVE-2026-61320?
The affected versions for CVE-2026-61320 are Oracle E-Business Suite versions 12.2.8 to 12.2.15.
Who is at risk from CVE-2026-61320?
Organizations using the affected versions of Oracle E-Business Suite with network access via HTTP are at risk from CVE-2026-61320.