This vulnerability affects the Oracle Process Manufacturing Product Development component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts, with no impact on availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for it. Customers are strongly advised to apply Oracle's Critical Patch Updates promptly to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible through Oracle Process Manufacturing Product Development. This compromises confidentiality and integrity of the data but does not impact availability. The vulnerability can be exploited remotely over the network via HTTP by an attacker with low privileges, increasing the risk of data compromise within affected environments.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities across Oracle products, including Oracle Process Manufacturing Product Development. However, the advisory does not explicitly confirm the patch status for CVE-2026-61030. Customers should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and apply the relevant patches without delay. Staying on actively supported versions and promptly applying Oracle security patches is strongly recommended to mitigate this vulnerability.