CVE-2026-61009 affects Oracle Process Manufacturing Logistics versions 12.2.3 to 12.2.15 within Oracle E-Business Suite. It is a difficult to exploit vulnerability that requires a high privileged attacker with network access via HTTP. Successful exploitation can result in complete takeover of the affected product, impacting confidentiality, integrity, and availability. The vulnerability also has potential scope change effects impacting other Oracle products. The CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H with a base score of 8.0. Oracle’s July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this specific vulnerability and product version. Customers are advised to consult the advisory for patch availability.

Successful exploitation of this vulnerability can lead to full compromise of Oracle Process Manufacturing Logistics, affecting confidentiality, integrity, and availability of the system. The vulnerability requires a high privileged attacker with network access via HTTP and does not require user interaction. There is also a scope change, meaning additional Oracle products may be impacted by attacks leveraging this vulnerability. No known exploits in the wild have been reported to date.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities including this one. However, explicit patch availability or remediation status for Oracle Process Manufacturing Logistics versions 12.2.3 to 12.2.15 is not confirmed in the advisory. Customers should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply relevant patches promptly. Until patches are applied, limit network access to the affected product to trusted users with high privileges and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.