Description
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Marketing accessible data as well as unauthorized read access to a subset of Oracle Marketing accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Marketing. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Published: 2026-07-21
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A low privileged attacker with network access via HTTP can exploit a vulnerability in Oracle Marketing to perform unauthorized update, insert, or delete operations on data, read restricted data, and trigger a partial denial of service. The flaw enables manipulation of Oracle Marketing accessible data and can interrupt services, affecting confidentiality, integrity, and availability in a limited scope.

Affected Systems

Oracle Marketing, part of Oracle E-Business Suite (Audience component), versions 12.2.3 through 12.2.15 are affected.

Risk and Exploitability

The CVSS 3.1 base score of 6.3 indicates a moderate risk, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the vulnerable system over standard HTTP traffic, potentially using the absence of proper access controls identified by CWE-284 to elevate their privileges and manipulate data or disrupt services.

Generated by OpenCVE AI on August 4, 2026 at 16:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch or update for Oracle Marketing to remove the access control flaw
  • Upgrade Oracle Marketing to a version beyond 12.2.15 if available
  • Restrict HTTP access to the Oracle Marketing instance using network segmentation or firewall rules to limit exposure to low privileged actors

Generated by OpenCVE AI on August 4, 2026 at 16:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Title Oracle Marketing Access Control Flaw Allows Unauthorized Data Modification and Partial DoS

Sun, 02 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Title Oracle Marketing Access Control Flaw Allows Unauthorized Data Modification and Partial DoS

Sat, 01 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Title Oracle Marketing Access Control Flaw Enables Unauthorized Data Manipulation and Partial Denial of Service

Mon, 27 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Oracle Marketing Access Control Flaw Enables Unauthorized Data Manipulation and Partial Denial of Service

Wed, 22 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Marketing accessible data as well as unauthorized read access to a subset of Oracle Marketing accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Marketing. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
First Time appeared Oracle
Oracle marketing
CPEs cpe:2.3:a:oracle:marketing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle marketing
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

Subscriptions

Oracle Marketing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-22T14:56:23.309Z

Reserved: 2026-07-08T15:52:20.744Z

Link: CVE-2026-61277

cve-icon Vulnrichment

Updated: 2026-07-22T14:55:03.607Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T16:15:03Z

Weaknesses