This vulnerability affects Oracle Demantra Demand Management within Oracle Supply Chain, specifically versions 12.2.3 through 12.2.15. It is easily exploitable by an attacker with low privileges who has network access via HTTP. The vulnerability can lead to a complete compromise of the product, with a scope change that may affect other Oracle products. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. The vendor advisory from Oracle (https://www.oracle.com/security-alerts/cpujul2026.html) references this vulnerability as part of the July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation details for this specific CVE. No known exploits in the wild have been reported.

Successful exploitation allows an attacker with low privileges and network access to take over Oracle Demantra Demand Management, resulting in full compromise of confidentiality, integrity, and availability of the affected product. The vulnerability may also impact additional Oracle products beyond Demantra Demand Management due to scope change.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the vendor advisory does not explicitly confirm the availability of a patch or remediation for CVE-2026-61041 at this time. Customers should monitor the Oracle Critical Patch Update advisory and apply patches promptly once they become available. Until an official fix is confirmed, no specific mitigation steps are provided by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.