CVE-2026-61047: Oracle Production Scheduling Privilege Escalation

CVE-2026-61047 Overview

CVE-2026-61047 affects the Oracle Production Scheduling product within Oracle E-Business Suite, specifically the Internal Operations component. The flaw impacts supported versions 12.2.3 through 12.2.15. A high-privileged attacker with local logon access to the infrastructure running Oracle Production Scheduling can exploit this weakness. Successful exploitation allows unauthorized update, insert, or delete operations against a subset of Oracle Production Scheduling data. The attack complexity is high and no confidentiality or availability impact is possible, limiting the practical risk to integrity of application data.

Critical Impact
Authenticated local attackers with high privileges can perform unauthorized modifications to Oracle Production Scheduling data, affecting data integrity within Oracle E-Business Suite deployments.

Affected Products

Oracle E-Business Suite - Oracle Production Scheduling versions 12.2.3 through 12.2.15
Component: Internal Operations
Attack surface: local infrastructure hosting Oracle Production Scheduling

Discovery Timeline

2026-07-21 - CVE CVE-2026-61047 published to NVD
2026-07-21 - Last updated in NVD database
Vendor advisory published as part of the Oracle Critical Patch Update - July 2026

Technical Details for CVE-2026-61047

Vulnerability Analysis

CVE-2026-61047 resides in the Internal Operations component of Oracle Production Scheduling. Exploitation requires an authenticated attacker holding high privileges on the host running the product. The vulnerability does not enable data disclosure or service disruption. Impact is limited to integrity, allowing modification of a subset of application data.

The EPSS score is 0.119% with a percentile of 2.066, indicating a very low predicted likelihood of exploitation in the wild. No public exploit code, CISA KEV entry, or ExploitDB record is available at the time of publication. The high attack complexity combined with the local vector and required high privileges significantly narrows the realistic threat model to insiders or attackers who have already achieved a foothold on the application host.

Root Cause

Oracle has not published detailed root cause information beyond the classification within the July 2026 Critical Patch Update advisory. The advisory categorizes the flaw as an integrity issue in the Internal Operations component, exploitable only by an authenticated user with existing high-privilege access to the underlying infrastructure.

Attack Vector

The vector is local (AV:L). An attacker must already be logged into the infrastructure where Oracle Production Scheduling executes and must hold high privileges (PR:H). No user interaction is required, but the attack complexity is high (AC:H), suggesting specific preconditions or timing must be satisfied. Successful exploitation yields low integrity impact (I:L) with no confidentiality or availability effect.

No verified proof-of-concept code is publicly available. Refer to the Oracle Critical Patch Update advisory for vendor-specific technical guidance.

Detection Methods for CVE-2026-61047

Indicators of Compromise

Unexpected modifications, inserts, or deletions in Oracle Production Scheduling data tables associated with the Internal Operations component.
Logon sessions on the Oracle Production Scheduling host from high-privileged accounts outside of scheduled maintenance windows.
Deviations from baseline scheduling data patterns without corresponding change management records.

Detection Strategies

Enable and review Oracle E-Business Suite audit logging for the Production Scheduling module, focusing on data modification events.
Correlate operating system authentication events on the host with application-level changes to identify unauthorized privileged activity.
Alert on privileged account use that does not map to an approved change ticket or automation workflow.

Monitoring Recommendations

Monitor host-level logon events for accounts with administrative rights on the Oracle Production Scheduling infrastructure.
Track database change events on Production Scheduling schemas and compare against expected batch or user activity.
Forward host, database, and application logs to a centralized analytics platform for cross-source correlation and long-term retention.

How to Mitigate CVE-2026-61047

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite deployments running Oracle Production Scheduling versions 12.2.3 through 12.2.15.
Inventory hosts running Oracle Production Scheduling and confirm patch status through configuration management.
Review and reduce the population of accounts holding high privileges on the Production Scheduling infrastructure.

Patch Information

Oracle addressed CVE-2026-61047 in the July 2026 Critical Patch Update. Patch details, download links, and installation instructions are available in the Oracle Critical Patch Update - July 2026 advisory. Administrators should follow Oracle's documented pre-installation and post-installation validation steps for the Production Scheduling module.

Workarounds

Restrict interactive and remote logon to the Oracle Production Scheduling host to a minimal set of administrators.
Enforce multi-factor authentication and just-in-time access for privileged accounts on the application server.
Apply operating system and database access controls to limit which authenticated users can invoke Internal Operations functionality until the patch is deployed.

bash

# Configuration example: verify installed Oracle E-Business Suite patch level
# Run on the application tier as the applmgr user
source $APPL_TOP/APPS<CONTEXT_NAME>.env
adop -status
# Query applied patches for Production Scheduling
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPU_JUL2026_PATCH_ID>');
EOF