This vulnerability (CVE-2026-61009) exists in Oracle Process Manufacturing Logistics within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows a high privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 score of 8.0 with high impact on confidentiality, integrity, and availability, and involves a scope change that may affect other Oracle products. The vulnerability is difficult to exploit and requires high privileges. Oracle’s July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for this specific vulnerability. Customers are urged to stay current with patches and consult the advisory for detailed remediation instructions.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Process Manufacturing Logistics, affecting confidentiality, integrity, and availability of the system. The vulnerability also has a scope change, meaning it may significantly impact additional Oracle products beyond the initially affected component. The attack requires high privileges and network access via HTTP, and although difficult to exploit, the impact is severe.

Oracle has released a Critical Patch Update in July 2026 addressing numerous vulnerabilities. Although the advisory does not explicitly confirm a patch for CVE-2026-61009, customers should promptly review and apply the July 2026 Critical Patch Update and any subsequent patches relevant to Oracle Process Manufacturing Logistics. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status for this specific vulnerability is not explicitly confirmed; therefore, users should monitor Oracle’s official advisory for updates and remediation guidance.