CVE-2026-61049

State: Published
Severity: 7.1 High
Published: Jul 21, 2026
Updated: Jul 24, 2026
Reserved: Jul 8, 2026

Description

Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Production Scheduling executes to compromise Oracle Production Scheduling. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Production Scheduling. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	oracle

Weaknesses

CWE-284 Improper Access Control
CWE-287 Improper Authentication
CWE-640 Weak Password Recovery Mechanism for Forgotten Password

Affected Products

Product	Versions
Oracle Production SchedulingOracle Corporation	12.2.3 through 12.2.15Affected

References

Oracle Advisoryvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.