Is CVE-2026-61014 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61014 being exploited in the wild.

How severe is CVE-2026-61014?

High severity, with a CVSS score of 7.7, published 21 July 2026.

Which products and versions are affected?

Oracle Corporation Inventory Management 12.2.3-12.2.15.

Is there a fix for CVE-2026-61014?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-61014 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-61014?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61014: Oracle E-Business Suite information disclosure in Inventory Management

CVE-2026-61014 · Severity: high · CVSS 7.7 · Published 2026-07-21

A vulnerability exists in the Oracle Inventory Management component of the Oracle E-Business Suite, which is used by organizations to track and manage supply chain assets. A low-privileged user could exploit this flaw to gain unauthorized access to sensitive business data. This could lead to a significant breach of confidential inventory records and potentially impact other integrated business systems.

Quick answers

Is CVE-2026-61014 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61014 being exploited in the wild.
How severe is CVE-2026-61014?: High severity, with a CVSS score of 7.7, published 21 July 2026.
Which products and versions are affected?: Oracle Corporation Inventory Management 12.2.3-12.2.15.
Is there a fix for CVE-2026-61014?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-61014 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-61014?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability affects the Internal Operations component of Oracle Inventory Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is categorized as an information disclosure flaw that is easily exploitable over the network via HTTP. An attacker with low-level privileges can bypass intended access controls to view critical data or all data accessible to the Inventory Management module. Notably, the vulnerability involves a 'scope change' (S:C), meaning an exploit can impact security components beyond the immediate Inventory Management environment. Users are advised to refer to the Oracle July 2026 Critical Patch Update for remediation steps.

Affected products

Oracle Corporation Inventory Management 12.2.3-12.2.15

Timeline

2026-07-21: disclosed
2026-07-21: advisory

References

https://www.oracle.com/security-alerts/cpujul2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.