Description
Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). The supported version that is affected is 12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Benefits. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Benefits accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-07-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is an Authorization Bypass in Oracle Advanced Benefits 12.2.15, classified as CWE‑284. The vulnerability permits a low‑privileged attacker with network access via HTTP to compromise the application, resulting in unauthorized access to critical data or complete possession of all data reachable by the application. This leads to a high confidentiality impact while integrity and availability remain unaffected.

Affected Systems

Oracle Advanced Benefits version 12.2.15, part of Oracle E‑Business Suite. No other versions or products are listed as impacted.

Risk and Exploitability

The CVSS v3.1 base score of 6.5 indicates a moderate risk. The EPSS score is below 1 %, suggesting a very low expected exploitation probability. The vulnerability is not listed in the CISA KEV catalog. A low‑privileged attacker can exploit the weakness over a network-based HTTP connection without needing elevated privileges or special authorization beyond the baseline access level.

Generated by OpenCVE AI on August 4, 2026 at 00:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle Advanced Benefits update that includes a fix for the authorization bypass
  • Restrict inbound HTTP traffic to the Advanced Benefits application through firewall rules or VPN access
  • Enforce the principle of least privilege on all accounts that interact with Oracle Advanced Benefits

Generated by OpenCVE AI on August 4, 2026 at 00:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Authorization Bypass in Oracle Advanced Benefits 12.2.15 Allows Data Theft

Thu, 30 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
Title Authorization Bypass in Oracle Advanced Benefits 12.2.15 Allows Data Theft

Wed, 29 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 27 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Authorization Bypass in Oracle Advanced Benefits Allowing Unauthorized Data Access

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Authorization Bypass in Oracle Advanced Benefits Allowing Unauthorized Data Access

Wed, 22 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). The supported version that is affected is 12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Benefits. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Benefits accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle advanced Benefits
CPEs cpe:2.3:a:oracle:advanced_benefits:12.2.15:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle advanced Benefits
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Advanced Benefits
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-29T19:26:40.670Z

Reserved: 2026-07-08T15:52:20.747Z

Link: CVE-2026-61323

cve-icon Vulnrichment

Updated: 2026-07-22T17:55:13.644Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T01:00:05Z

Weaknesses