Description
Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Product Development. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Process Manufacturing Product Development accessible data as well as unauthorized access to critical data or complete access to all Oracle Process Manufacturing Product Development accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An improper access control flaw (CWE‑284) in the Oracle Process Manufacturing Product Development component allows a low‑privileged attacker who can reach the application over HTTP to create, delete, or modify critical data. Successful exploitation leads to confidentiality and integrity compromise of the data as well as the possibility of obtaining unrestricted view of all application data.

Affected Systems

Oracle Process Manufacturing Product Development within Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, in the Internal Operations component is affected.

Risk and Exploitability

The CVSS 3.1 base score of 8.1 reflects a high impact on confidentiality and integrity. An EPSS score of less than 1 % indicates a low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The attack can be carried out over the network by sending crafted HTTP requests; the attacker only needs low‑privilege network access.

Generated by OpenCVE AI on August 4, 2026 at 02:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle CPU July 2026 security patch that addresses CVE‑2026‑61030.
  • Restrict HTTP traffic to the Process Manufacturing servers by limiting access to internal networks or VPN connections.
  • Enforce least‑privilege principles for internal operation accounts and tighten access controls to prevent unauthorized data changes.

Generated by OpenCVE AI on August 4, 2026 at 02:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification in Oracle Process Manufacturing Product Development via Improper Access Control

Sun, 02 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Title Improper Access Control Enabling Low‑Privilege Data Modification in Oracle Process Manufacturing Product Development

Thu, 30 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Title Improper Access Control Enabling Low‑Privilege Data Modification in Oracle Process Manufacturing Product Development

Tue, 28 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Title Easily Exploitable Low-Privilege HTTP Attack Enables Unauthorized Data Modification in Oracle Process Manufacturing Product Development

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Easily Exploitable Low-Privilege HTTP Attack Enables Unauthorized Data Modification in Oracle Process Manufacturing Product Development
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Product Development. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Process Manufacturing Product Development accessible data as well as unauthorized access to critical data or complete access to all Oracle Process Manufacturing Product Development accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle process Manufacturing Product Development
CPEs cpe:2.3:a:oracle:process_manufacturing_product_development:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle process Manufacturing Product Development
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Process Manufacturing Product Development
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T14:48:02.734Z

Reserved: 2026-07-08T15:51:55.608Z

Link: CVE-2026-61030

cve-icon Vulnrichment

Updated: 2026-07-24T14:47:55.917Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:18:34.370

Modified: 2026-08-04T17:00:34.047

Link: CVE-2026-61030

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T02:15:04Z

Weaknesses