This vulnerability affects Oracle Project Foundation within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure hosting the product. The vulnerability can result in complete compromise of Oracle Project Foundation. The CVSS 3.1 base score is 7.8, indicating high severity, with impacts on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-269 (Improper Privilege Management). No official patch or remediation level is explicitly stated in the vendor advisory, but Oracle's July 2026 Critical Patch Update advisory references multiple patches and strongly recommends applying security patches promptly. No known exploits in the wild have been reported.

Successful exploitation allows an attacker with low privileges and logon access to the Oracle Project Foundation infrastructure to fully compromise the product. This results in high impact on confidentiality, integrity, and availability of Oracle Project Foundation, potentially allowing complete takeover of the system.

Oracle's July 2026 Critical Patch Update advisory recommends applying the latest security patches without delay. Although no specific patch for CVE-2026-61090 is explicitly detailed in the advisory content provided, Oracle strongly advises customers to remain on actively supported versions and promptly apply security updates. Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.