This vulnerability affects Oracle Production Scheduling versions 12.2.3 through 12.2.15. It permits a high privileged attacker with network access over HTTP to compromise the product by unauthorized modification and reading of some accessible data, as well as causing partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state a dedicated patch or remediation level for it. Customers are advised to apply Oracle's cumulative security patches promptly.

Successful exploitation can lead to unauthorized update, insert, or delete access to some Oracle Production Scheduling accessible data, unauthorized read access to a subset of accessible data, and the ability to cause a partial denial of service. The impact on confidentiality, integrity, and availability is rated low. The attacker must have high privileges and network access via HTTP to exploit this vulnerability.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability in its cumulative security patches. Although no explicit patch or remediation level is stated for CVE-2026-61044, Oracle strongly recommends applying the latest Critical Patch Update without delay to mitigate this and other vulnerabilities. There are no vendor advisories indicating that no action is required or that the issue is already mitigated. Organizations should verify patch availability and installation instructions via the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html.