This vulnerability in Oracle Concurrent Processing allows an attacker with low privileges and network access via HTTP to compromise the product by unauthorized modification and reading of accessible data and causing partial denial of service. The affected versions include 12.2.3 through 12.2.15. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for this specific issue. Oracle strongly recommends applying security patches from Critical Patch Updates without delay.

Successful exploitation can lead to unauthorized update, insert, or delete access to some Oracle Concurrent Processing accessible data, unauthorized read access to a subset of that data, and the ability to cause a partial denial of service. The confidentiality, integrity, and availability impacts are rated low but combined justify a medium severity rating. There are no reports of known exploits in the wild at this time.

Oracle's July 2026 Critical Patch Update advisory includes multiple security patches and recommends customers apply these patches promptly. Although the advisory does not explicitly confirm a patch for CVE-2026-61051, customers should remain on actively supported versions and apply the latest Critical Patch Updates without delay to mitigate this vulnerability. Monitor Oracle's official security advisories for specific patch availability and installation instructions related to this vulnerability.