This vulnerability affects Oracle iRecruitment, a component of Oracle E-Business Suite (Internal Operations), in versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to gain unauthorized access, enabling creation, deletion, or modification of critical or all accessible data within Oracle iRecruitment. The CVSS 3.1 base score is 8.1, indicating high severity with high confidentiality and integrity impacts and no impact on availability. The vulnerability is easily exploitable and does not require user interaction. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for this specific vulnerability. Customers are advised to review the advisory and apply relevant patches promptly.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle iRecruitment. This results in a high impact on confidentiality and integrity of the affected system's data. There is no reported impact on system availability. The vulnerability allows attackers with low privileges and network access to escalate their capabilities significantly within the Oracle iRecruitment environment.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses numerous vulnerabilities across its product portfolio. While the advisory includes Oracle iRecruitment among affected products, it does not explicitly confirm the patch status for CVE-2026-61024. Customers should consult the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. It is strongly recommended to apply all relevant security patches promptly and remain on actively supported versions. Patch status is not yet confirmed specifically for this vulnerability; therefore, checking the vendor advisory for current remediation guidance is essential.