This vulnerability affects Oracle Process Manufacturing Logistics component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory mentions a large number of patches but does not explicitly confirm a patch or remediation level for this specific vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Process Manufacturing Logistics. This compromises confidentiality and integrity of the data but does not affect availability. The vulnerability allows a low privileged attacker with network access to escalate their access to critical data, posing a significant risk to data security within affected environments.

Oracle's July 2026 Critical Patch Update advisory includes numerous security patches across many products, but it does not explicitly confirm a patch or remediation level for CVE-2026-61005. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches without delay and remaining on actively supported versions. Until a specific patch is confirmed, organizations should consider restricting network access to Oracle Process Manufacturing Logistics interfaces and monitor for suspicious activity consistent with unauthorized data access attempts.