CVE-2026-61014 is a vulnerability in the Internal Operations component of Oracle Inventory Management within Oracle E-Business Suite. It affects supported versions from 12.2.3 up to 12.2.15. The vulnerability is easily exploitable by an attacker with low privileges who has network access via HTTP. Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by Oracle Inventory Management. The vulnerability has a CVSS 3.1 score of 7.7 with the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and no impact on integrity or availability. The vulnerability may also affect other Oracle products due to scope change. Oracle's July 2026 Critical Patch Update advisory references a large set of patches but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

The vulnerability allows an attacker with low privileges and network access via HTTP to gain unauthorized access to critical data or complete access to all data accessible by Oracle Inventory Management. The scope of impact may extend beyond Oracle Inventory Management to other Oracle products. The confidentiality of sensitive information is at high risk, while integrity and availability are not impacted according to the CVSS vector. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses numerous security vulnerabilities across Oracle products, including Oracle Inventory Management. However, the advisory content provided does not explicitly confirm the availability of a specific patch for CVE-2026-61014. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Applying the relevant patches promptly is recommended to mitigate this vulnerability. Patch status is not yet confirmed specifically for this CVE in the advisory content provided; therefore, check the vendor advisory for current remediation guidance.