CVE-2026-61138 in Complex Maintenance Repair and Overhaul
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair and Overhaul. While the vulnerability is in Oracle Complex Maintenance, Repair and Overhaul, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Complex Maintenance, Repair and Overhaul accessible data as well as unauthorized update, insert or delete access to some of Oracle Complex Maintenance, Repair and Overhaul accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability resides within Oracle Complex Maintenance, Repair and Overhaul component of the Oracle E-Business Suite ecosystem, specifically targeting the Internal Operations module. The affected versions span from 12.2.3 through 12.2.15, indicating a substantial attack surface across multiple release cycles. The flaw represents a significant security weakness that can be exploited by unauthenticated attackers possessing network access through HTTP protocols, making it particularly dangerous as it requires no prior authentication credentials to initiate exploitation attempts.
The technical nature of this vulnerability manifests as a remote code execution risk that operates at the application layer without requiring privileged access or user interaction. The CVSS 3.1 scoring system assigns it a base score of 7.5, reflecting high severity with confidentiality and integrity impacts rated as high while availability remains low. The attack vector AV:N indicates network-based exploitation is possible, while AC:H (high attack complexity) suggests sophisticated techniques may be required but not necessarily prohibitive. The PR:N classification confirms no privilege requirements exist for initial compromise, making this vulnerability particularly concerning for organizations with exposed web services.
The operational impact extends beyond the immediate scope of Complex Maintenance, Repair and Overhaul due to the scope change factor that allows attacks to potentially affect additional Oracle products within the E-Business Suite environment. Successful exploitation enables attackers to achieve unauthorized access to critical data repositories and can result in complete read access to all accessible data within the targeted system. Additionally, attackers may gain unauthorized update, insert, or delete capabilities affecting some of the accessible data, creating both data integrity and confidentiality risks that could severely impact business operations.
Organizations affected by this vulnerability should prioritize immediate remediation through official Oracle patches and updates released for the specific version ranges mentioned in the advisory. Network segmentation strategies should be implemented to limit exposure of vulnerable systems to untrusted networks, while enhanced monitoring of HTTP traffic can help detect potential exploitation attempts. The vulnerability aligns with CWE-287 (Improper Authentication) and potentially CWE-94 (Code Injection) depending on exploitation methods, and maps to ATT&CK techniques including T1190 (Exploit Public-Facing Application) and T1071.004 (Application Layer Protocol: DNS) for network-based attack methodologies. Regular vulnerability assessments and penetration testing should be conducted to identify similar weaknesses in related Oracle E-Business Suite components that may present analogous risk profiles requiring coordinated remediation efforts.