CVE-2026-61043 is a vulnerability in the Internal Operations component of Oracle Production Scheduling within Oracle E-Business Suite. It affects supported versions 12.2.3 through 12.2.15. The vulnerability allows a low privileged attacker who has logon access to the infrastructure where Oracle Production Scheduling runs to compromise the product. Successful exploitation requires human interaction from a person other than the attacker and may impact additional Oracle products beyond Production Scheduling (scope change). The impact includes unauthorized creation, deletion, or modification of critical or accessible data and unauthorized read access to some data. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N, with a base score of 6.7, indicating medium severity. Oracle's July 2026 Critical Patch Update advisory references many patches but does not explicitly confirm a fix for this vulnerability in the provided excerpt.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle Production Scheduling, as well as unauthorized read access to a subset of accessible data. The vulnerability affects confidentiality and integrity with no impact on availability. The scope change indicates that other Oracle products may be significantly impacted by attacks exploiting this vulnerability.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, limit low privileged user access to the infrastructure where Oracle Production Scheduling executes and educate users to avoid interactions that could facilitate exploitation.