This vulnerability affects Oracle Self-Service Human Resources component of Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access over HTTP to perform unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. The CVSS 3.1 base score is 5.4, reflecting low complexity attack vector (network), low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. The vulnerability is classified under CWE-284 (Improper Access Control). The vendor advisory from Oracle’s July 2026 Critical Patch Update does not explicitly confirm a patch or remediation status for this specific issue, though it strongly recommends applying available security patches promptly.

Successful exploitation can lead to unauthorized reading and modification (update, insert, delete) of certain data accessible through Oracle Self-Service Human Resources, potentially compromising data confidentiality and integrity. There is no impact on system availability. The attacker requires only low privileges and network access via HTTP, making exploitation relatively straightforward.

The Oracle July 2026 Critical Patch Update advisory does not explicitly confirm a patch for CVE-2026-61075. Oracle recommends that customers remain on actively supported versions and apply security patches without delay. Users should monitor Oracle’s official security alerts for patch availability and apply updates as soon as they are released. Until a patch is confirmed, consider restricting network access to the affected application and implementing compensating controls to limit unauthorized data access.