CVE-2026-61019 is a vulnerability in Oracle Customers Online component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible through Oracle Customers Online. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability is publicly known and published, but no explicit patch or remediation level is stated in the vendor advisory. Oracle’s July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability for this specific vulnerability. Customers are advised to review the advisory and apply relevant patches promptly.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Customers Online, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the data but does not affect availability. The vulnerability can be exploited remotely over the network by an attacker with low privileges, increasing the risk of data compromise in affected environments.

Oracle’s July 2026 Critical Patch Update advisory should be reviewed for patch availability and installation instructions. Although the advisory does not explicitly confirm a patch for CVE-2026-61019, Oracle strongly recommends applying all relevant security patches without delay to mitigate this and other vulnerabilities. Customers should remain on actively supported versions and promptly apply Oracle Critical Patch Updates. Patch status is not yet confirmed specifically for this vulnerability; therefore, check the vendor advisory for current remediation guidance.