This vulnerability affects Oracle Landed Cost Management versions 12.2.3 through 12.2.15 and enables a low privileged attacker with network access via HTTP to gain unauthorized access to critical data. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within the Oracle Landed Cost Management environment. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's July 2026 Critical Patch Update advisory references a large set of patches but does not explicitly confirm a patch for this specific vulnerability in the provided content. Customers are advised to review the advisory and apply patches promptly.

The vulnerability allows unauthorized access to critical data in Oracle Landed Cost Management, including the ability to create, delete, or modify such data. This compromises the confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities across Oracle products. Although the advisory does not explicitly confirm a patch for CVE-2026-61004 in the provided content, customers should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. It is strongly recommended to apply the relevant security patches without delay to mitigate this vulnerability. No alternative mitigations or workarounds are specified in the advisory content.