This vulnerability affects Oracle Landed Cost Management, a component of Oracle E-Business Suite (versions 12.2.3 to 12.2.15). It permits a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a fix for this vulnerability. Patch status is therefore not confirmed and should be verified with Oracle's advisory.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle Landed Cost Management. This compromises confidentiality and integrity of the data but does not impact availability. The attacker requires only low privileges and network access via HTTP to exploit this vulnerability.

Oracle has released a Critical Patch Update in July 2026 covering multiple vulnerabilities. However, the vendor advisory does not explicitly confirm a patch or fix for CVE-2026-61004. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant patches promptly. Until a patch is confirmed and applied, restrict network access to Oracle Landed Cost Management interfaces to trusted users only and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.