This vulnerability affects Oracle Performance Management versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, delete, and read operations on accessible data within the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impacts. The vendor advisory references a July 2026 Critical Patch Update containing numerous patches but does not explicitly confirm a patch for this specific vulnerability. Customers are strongly advised to apply available patches promptly as per Oracle's general guidance.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through Oracle Performance Management. This compromises data confidentiality and integrity but does not affect availability. The attacker requires only low privileges and network access via HTTP, making exploitation relatively easy if the system is exposed and unpatched.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay to address vulnerabilities including this one. However, the specific patch status for CVE-2026-61083 is not explicitly confirmed in the advisory. Customers should review the July 2026 Critical Patch Update documentation and apply relevant patches for Oracle Performance Management versions 12.2.3 through 12.2.15 as soon as possible. Until patches are applied, restrict network access to Oracle Performance Management HTTP interfaces to trusted users only.