This vulnerability in Oracle iRecruitment (component: Install / Upgrade Issues) affects supported versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the application, resulting in unauthorized read and write (update, insert, delete) access to some accessible data. The CVSS 3.1 base score is 5.4, reflecting low complexity attack vector (network), low attack complexity, requiring low privileges but no user interaction, with limited confidentiality and integrity impact and no availability impact. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes numerous patches, but does not explicitly state the patch status for this vulnerability.

Successful exploitation allows unauthorized read access to a subset of Oracle iRecruitment accessible data and unauthorized update, insert, or delete access to some data. This compromises confidentiality and integrity of affected data within Oracle iRecruitment. There is no reported impact on system availability. The vulnerability can be exploited remotely over HTTP by an attacker with low privileges.

Oracle has included this vulnerability in their July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm whether a patch for CVE-2026-61064 is available or provide specific remediation instructions. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches promptly. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.