CVE-2026-61051 affects Oracle Concurrent Processing component of Oracle E-Business Suite (BI Publisher Integration) versions 12.2.3 through 12.2.15. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized ability to read, update, insert, or delete some accessible data and cause a partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. Oracle’s July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation level for this vulnerability. No known exploits in the wild have been reported.

The vulnerability allows unauthorized read and write access to some data within Oracle Concurrent Processing, potentially compromising confidentiality and integrity of that data. It also enables an attacker to cause a partial denial of service, impacting availability. The CVSS score of 6.3 reflects medium severity with low but non-negligible impacts on confidentiality, integrity, and availability. The attacker requires network access and low privileges but no user interaction.

Oracle’s July 2026 Critical Patch Update advisory includes numerous security patches across many products. Although the advisory does not explicitly confirm a patch for CVE-2026-61051, customers are strongly recommended to apply the latest Critical Patch Update without delay to address this and other vulnerabilities. Patch status for this specific vulnerability is not explicitly confirmed; therefore, customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. No vendor advisory states that no action is required or that the issue is already mitigated.