Description
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.13-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Bills of Material accessible data as well as unauthorized access to critical data or complete access to all Oracle Bills of Material accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A low‑privileged adversary with network connectivity via HTTP can exploit a flaw in Oracle Bills of Material, enabling unauthorized creation, deletion or alteration of critical data. This access control weakness can also grant unchecked read access to all data handled by the component, potentially exposing sensitive information. The vulnerability is identified as CWE‑284.

Affected Systems

Oracle Bills of Material, part of Oracle E‑Business Suite, is affected for all releases version 12.2.13 through 12.2.15. These versions remain supported and are the only ones explicitly targeted by the advisory.

Risk and Exploitability

The CVSS v3.1 base score of 8.1 indicates significant confidentiality and integrity impact. The attack vector is via network (HTTP) and requires only low privileges, but not user interaction. With an EPSS score of less than 1 % and the vulnerability not listed in the CISA KEV catalog, the likelihood of exploitation remains modest, yet the potential damage is high should an attacker succeed.

Generated by OpenCVE AI on August 4, 2026 at 00:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle Bills of Material patch that addresses CVE‑2026‑61327 as distributed in the July 2026 CPU.
  • Limit HTTP access to the Bills of Material service by firewall rules or VLAN segmentation so that only trusted hosts can reach the component.
  • Perform a role review for all users with access to Bills of Material to ensure only the minimum required privileges are granted.

Generated by OpenCVE AI on August 4, 2026 at 00:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Access Control Weakness in Oracle Bills of Material Allows Unauthorized Data Modification

Thu, 30 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Title Access Control Weakness in Oracle Bills of Material Allows Unauthorized Data Modification

Tue, 28 Jul 2026 19:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via Low‑Privilege HTTP Exploit in Oracle Bills of Material

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via Low‑Privilege HTTP Exploit in Oracle Bills of Material

Wed, 22 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.13-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Bills of Material accessible data as well as unauthorized access to critical data or complete access to all Oracle Bills of Material accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle bills Of Material
CPEs cpe:2.3:a:oracle:bills_of_material:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle bills Of Material
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Bills Of Material
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-22T17:53:10.774Z

Reserved: 2026-07-08T15:52:20.747Z

Link: CVE-2026-61327

cve-icon Vulnrichment

Updated: 2026-07-22T17:53:02.291Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T01:00:05Z

Weaknesses