CVE-2026-61283

{"id": "CVE-2026-61283", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61283", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T14:41:27.757285Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "Oracle Bills of Material", "versions": [{"status": "affected", "version": "12.2.3", "versionType": "custom", "lessThanOrEqual": "12.2.15"}]}]}], "published": "2026-07-21T22:18:58.417", "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2026.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Web Services). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Bills of Material accessible data as well as unauthorized read access to a subset of Oracle Bills of Material accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Bills of Material. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Bills of Material de Oracle E-Business Suite (componente: Web Services). Las versiones soportadas que est\u00e1n afectadas son 12.2.3-12.2.15. Vulnerabilidad f\u00e1cilmente explotable permite a un atacante con pocos privilegios con acceso a la red v\u00eda HTTP comprometer Oracle Bills of Material. Ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado de actualizaci\u00f3n, inserci\u00f3n o eliminaci\u00f3n a algunos de los datos accesibles de Oracle Bills of Material, as\u00ed como acceso de lectura no autorizado a un subconjunto de los datos accesibles de Oracle Bills of Material y la capacidad no autorizada de causar una denegaci\u00f3n de servicio parcial (DoS parcial) de Oracle Bills of Material. Puntuaci\u00f3n Base CVSS 3.1 6.3 (impactos en Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)."}], "lastModified": "2026-10-24T17:10:00.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:bills_of_material:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37E3BD7B-9A15-4D43-9EC3-049EDC592A27", "versionEndIncluding": "12.2.15", "versionStartIncluding": "12.2.3"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}