CVE-2026-61010 is a vulnerability in Oracle Process Manufacturing Systems component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system, potentially resulting in complete system takeover. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability relates to improper access control and authorization issues (CWE-306, CWE-287, CWE-269, CWE-284). Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability for this specific vulnerability. No known exploits in the wild have been reported yet.

Successful exploitation of this vulnerability can lead to full compromise of Oracle Process Manufacturing Systems, impacting confidentiality, integrity, and availability of the affected system. This could allow an attacker to take over the system with low privileges and network access via HTTP.

Oracle has released a Critical Patch Update advisory in July 2026 addressing numerous vulnerabilities across its product portfolio. Although the advisory does not explicitly confirm a patch for CVE-2026-61010, users of Oracle Process Manufacturing Systems versions 12.2.3 through 12.2.15 should promptly review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply any relevant patches or updates provided by Oracle. Patch status is not yet confirmed specifically for this vulnerability; therefore, checking the vendor advisory for current remediation guidance is essential.