This vulnerability affects Oracle iRecruitment within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impacts without availability impact. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references a Critical Patch Update containing multiple fixes. Oracle strongly recommends applying security patches without delay to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized reading and modification (update, insert, delete) of some data accessible through Oracle iRecruitment. This compromises confidentiality and integrity of affected data but does not impact system availability. The attack requires network access via HTTP and low privileges, increasing the risk in exposed environments.

Oracle has not explicitly stated a dedicated patch or remediation level for CVE-2026-61064 in the provided advisory. However, it is included in the July 2026 Critical Patch Update, which contains numerous security fixes. Oracle strongly recommends that customers apply the latest Critical Patch Updates promptly and remain on actively supported versions. No vendor advisory states that no action is required or that the issue is already mitigated. Therefore, organizations should verify patch availability via the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply relevant patches as soon as possible.