This vulnerability affects the Oracle Process Manufacturing Systems component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is exploitable remotely over HTTP by an attacker with low privileges and no user interaction required. Successful exploitation can lead to complete compromise of the affected system, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for this vulnerability in the provided excerpt. The vendor strongly recommends applying security patches promptly to mitigate risks.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to fully compromise Oracle Process Manufacturing Systems. This includes unauthorized access to sensitive data (confidentiality impact), unauthorized modification of data or system state (integrity impact), and disruption of system availability. The high CVSS score of 8.8 reflects the critical nature of this impact.

Oracle's July 2026 Critical Patch Update advisory recommends applying the latest security patches without delay. However, the advisory content provided does not explicitly confirm a patch for CVE-2026-61010. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Until a patch is confirmed and applied, restrict network access to Oracle Process Manufacturing Systems to trusted users only and monitor for suspicious activity related to this component.