CVE-2026-61125: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Configure to Order. While the vulnerability is in Oracle Configure to Order, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configure to Order accessible data. in Oracle Corporation Oracle Configure to Order
CVE-2026-61125 is a high-severity vulnerability in Oracle Configure to Order, part of Oracle E-Business Suite's Supply to Order Workbench. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to unauthorized access to critical or all accessible data. The vulnerability affects versions 12.2.3 through 12.2.15. The vulnerability has a CVSS 3.1 base score of 7.7, indicating significant confidentiality impact without integrity or availability loss. Oracle has published a Critical Patch Update advisory in July 2026 addressing this and many other vulnerabilities. No explicit patch or remediation level is stated for this specific vulnerability in the advisory, so users should consult the vendor advisory for patch availability and apply updates promptly.
AI Analysis
Technical Summary
CVE-2026-61125 is a vulnerability in Oracle Configure to Order (component: Supply to Order Workbench) versions 12.2.3 to 12.2.15 that allows a low privileged attacker with network access via HTTP to compromise the product. The vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Configure to Order. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and no integrity or availability impact. While the vulnerability is specific to Oracle Configure to Order, exploitation may impact additional Oracle products due to scope change. Oracle's July 2026 Critical Patch Update advisory includes multiple patches but does not explicitly confirm patch availability for this vulnerability. Users are advised to review the advisory and apply patches accordingly.
Potential Impact
Successful exploitation of this vulnerability can result in unauthorized access to critical or all accessible data within Oracle Configure to Order. The confidentiality impact is high, but there is no impact on integrity or availability. The vulnerability can be exploited remotely over the network by an attacker with low privileges and no user interaction is required. Additionally, the vulnerability's exploitation may affect other Oracle products beyond Oracle Configure to Order due to scope change.
Mitigation Recommendations
Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities including this one. However, the advisory does not explicitly confirm the patch status for CVE-2026-61125. Users should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. It is strongly recommended to apply the relevant security patches promptly to mitigate this vulnerability. No vendor advisory states that no action is required or that the issue is already mitigated.
CVE-2026-61125: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Configure to Order. While the vulnerability is in Oracle Configure to Order, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configure to Order accessible data. in Oracle Corporation Oracle Configure to Order
Description
CVE-2026-61125 is a high-severity vulnerability in Oracle Configure to Order, part of Oracle E-Business Suite's Supply to Order Workbench. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to unauthorized access to critical or all accessible data. The vulnerability affects versions 12.2.3 through 12.2.15. The vulnerability has a CVSS 3.1 base score of 7.7, indicating significant confidentiality impact without integrity or availability loss. Oracle has published a Critical Patch Update advisory in July 2026 addressing this and many other vulnerabilities. No explicit patch or remediation level is stated for this specific vulnerability in the advisory, so users should consult the vendor advisory for patch availability and apply updates promptly.
CVSS v3.1
Score 7.7high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-61125 is a vulnerability in Oracle Configure to Order (component: Supply to Order Workbench) versions 12.2.3 to 12.2.15 that allows a low privileged attacker with network access via HTTP to compromise the product. The vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Configure to Order. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and no integrity or availability impact. While the vulnerability is specific to Oracle Configure to Order, exploitation may impact additional Oracle products due to scope change. Oracle's July 2026 Critical Patch Update advisory includes multiple patches but does not explicitly confirm patch availability for this vulnerability. Users are advised to review the advisory and apply patches accordingly.
Potential Impact
Successful exploitation of this vulnerability can result in unauthorized access to critical or all accessible data within Oracle Configure to Order. The confidentiality impact is high, but there is no impact on integrity or availability. The vulnerability can be exploited remotely over the network by an attacker with low privileges and no user interaction is required. Additionally, the vulnerability's exploitation may affect other Oracle products beyond Oracle Configure to Order due to scope change.
Mitigation Recommendations
Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities including this one. However, the advisory does not explicitly confirm the patch status for CVE-2026-61125. Users should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. It is strongly recommended to apply the relevant security patches promptly to mitigate this vulnerability. No vendor advisory states that no action is required or that the issue is already mitigated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:55.614Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fee2f9c2644c7f8d5d336
Added to database: 07/21/2026, 22:09:51 UTC
Last enriched: 07/22/2026, 01:23:48 UTC
Last updated: 07/22/2026, 01:23:48 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.