This vulnerability affects Oracle Self-Service Human Resources versions 12.2.3 through 12.2.15 and allows an attacker with low privileges and network access via HTTP to gain unauthorized update, insert, delete, and read access to certain data within the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts. The vulnerability is publicly disclosed and assigned CVE-2026-61075. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for this specific vulnerability. Customers are advised to consult the advisory and apply relevant patches promptly.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through Oracle Self-Service Human Resources. This compromises data confidentiality and integrity but does not affect system availability. The attacker requires network access and low privileges but no user interaction is needed.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities across its product portfolio. Although the advisory does not explicitly confirm a patch for CVE-2026-61075, customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches for Oracle Self-Service Human Resources versions 12.2.3 through 12.2.15 without delay. Remaining on actively supported versions and timely patching is strongly recommended. Patch status is not yet confirmed specifically for this CVE; check the vendor advisory for current remediation guidance.