This vulnerability affects Oracle Financials Common Country (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or full access to all accessible data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for this specific issue. Oracle strongly recommends applying security patches from Critical Patch Updates without delay.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Financials Common Country, or unauthorized access to all data accessible by this component. This compromises confidentiality and integrity of sensitive financial data. There is no reported impact on availability. No known exploits in the wild have been reported to date.

Oracle's July 2026 Critical Patch Update advisory includes numerous security patches and recommends customers apply these patches promptly. Although no explicit patch or remediation level is stated for CVE-2026-61031, customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches for Oracle Financials Common Country versions 12.2.3 through 12.2.15. Maintaining up-to-date patching is the primary mitigation. No vendor advisory states that no action is required or that the vulnerability is already mitigated.