This vulnerability (CVE-2026-61039) exists in Oracle Advanced Supply Chain Planning versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to compromise the system, resulting in potential full takeover of the product. The vulnerability is classified under CWE-284 (Improper Access Control). The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation level for this specific issue. Customers should consult the advisory and apply patches as recommended.

Successful exploitation can lead to complete compromise of Oracle Advanced Supply Chain Planning, impacting confidentiality, integrity, and availability of the affected system. This could allow attackers to take over the application, potentially disrupting supply chain planning operations and exposing sensitive business data.

Oracle's July 2026 Critical Patch Update advisory includes security patches addressing multiple vulnerabilities. Although no explicit patch or remediation level is confirmed for CVE-2026-61039 in the provided advisory content, Oracle strongly recommends applying all relevant Critical Patch Updates without delay. Customers should verify patch availability and installation instructions in the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html and ensure their Oracle Advanced Supply Chain Planning installations are updated to the latest supported and patched versions.