OracleCVE-2026-61110

Oracle Applications DBA: takeover via ADPatch

CVE-2026-61110 · Published Jul 21, 2026 · updated Aug 1, 2026

High8.8

No fix yet

Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: ADPatch). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications DBA. Successful attacks of this vulnerability can result in takeover of Oracle Applications DBA. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected versions

Package	Affected	Fixed in
Oracle Applications DBA Product	>= 12.2.3, <= 12.2.15	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-269, CWE-287, CWE-306

More Oracle advisories

All Oracle

High 7.8Jul 21

Oracle HRMS (US): takeover via Internal OperationsCVE-2026-62561no fix yet Medium 6.5Jul 21

Oracle HRMS (US): data exposure via Internal OperationsCVE-2026-62562no fix yet Medium 5.4Jul 21

Oracle Work in Process: data tampering via Internal OperationsCVE-2026-62563no fix yet High 7.1Jul 21

Oracle HRMS (US): data tampering via US Payroll Year EndCVE-2026-62565no fix yet High 7.7Jul 21

Oracle HRMS (UK): data exposure via UK PayrollCVE-2026-62567no fix yet High 7.8Jul 21

Oracle Java SE: takeover via InstallCVE-2026-62574no fix yet