This vulnerability exists in the User Interface component of Oracle Inventory Optimization versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to cause a partial denial of service condition. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and low availability impact. The vulnerability is considered difficult to exploit. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state a dedicated patch or remediation level for it.

Successful exploitation can result in unauthorized partial denial of service of Oracle Inventory Optimization. There is no impact on confidentiality or integrity. The attack complexity is high, and the attacker requires low privileges and network access via HTTP. The overall severity is low.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm a dedicated patch or remediation level for CVE-2026-61048. Customers are strongly advised to remain on actively supported versions and apply Oracle Critical Patch Updates promptly. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.