CVE-2026-61020 is a vulnerability in Oracle Customers Online component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data. The vulnerability has a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact, no user interaction required, and low attack complexity. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for this vulnerability. The vendor strongly recommends applying patches without delay to mitigate exploitation risks.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Customers Online, as well as unauthorized access to all accessible data. This compromises both confidentiality and integrity of the affected system's data. Availability is not impacted according to the CVSS vector. The vulnerability is exploitable remotely over the network with low attack complexity and does not require user interaction.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. However, the advisory content does not explicitly confirm a patch or fix for CVE-2026-61020. Customers should review the July 2026 Critical Patch Update documentation and apply all relevant patches promptly. Staying on actively supported versions and applying Oracle security patches without delay is strongly recommended to mitigate this vulnerability. Patch status is not yet confirmed specifically for this vulnerability—check the vendor advisory for current remediation guidance.