This vulnerability exists in Oracle Demantra Demand Management within Oracle Supply Chain, affecting supported versions 12.2.3 through 12.2.15. It is easily exploitable by an attacker with low privileges who has network access via HTTP, allowing compromise of the product. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical impact on confidentiality, integrity, and availability. The scope of impact may extend to other Oracle products due to the nature of the compromise. Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm a patch for this vulnerability in the provided excerpt. No known exploits in the wild have been reported at this time.

Successful exploitation can lead to complete takeover of Oracle Demantra Demand Management, severely impacting confidentiality, integrity, and availability of the affected system. The vulnerability's scope change indicates potential collateral impact on other Oracle products integrated or dependent on Demantra. This represents a critical risk to affected environments.

Oracle has released a Critical Patch Update advisory in July 2026 addressing numerous vulnerabilities, including those in Oracle products. However, the provided advisory content does not explicitly confirm a patch for CVE-2026-61041. Customers should review the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. Until confirmed, patch status remains unverified. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions to mitigate exploitation risk.