This vulnerability affects Oracle Loans within Oracle E-Business Suite, versions 12.2.3 to 12.2.15. It is exploitable remotely over HTTP by an attacker with low privileges and no user interaction required. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, compromising confidentiality and integrity. The CVSS 3.1 base score is 8.1, reflecting high severity with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's July 2026 Critical Patch Update advisory references patches for multiple products but does not explicitly confirm a patch for this specific vulnerability. Customers are urged to apply available patches promptly.

The vulnerability allows unauthorized actors with low privileges and network access to compromise Oracle Loans data by creating, deleting, or modifying critical information. This leads to a high impact on confidentiality and integrity of the data managed by Oracle Loans. Availability is not affected. The compromise could extend to all data accessible by Oracle Loans, posing significant risk to data security and business operations.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple products, including Oracle Loans. However, the advisory does not explicitly confirm a patch for CVE-2026-61037. Customers should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and apply relevant patches without delay. Until patches are confirmed and applied, restrict network access to Oracle Loans and monitor for suspicious activity. Patch status is not yet confirmed explicitly for this vulnerability; check the vendor advisory for current remediation guidance.