This vulnerability affects Oracle Project Foundation, a component of Oracle E-Business Suite, specifically versions 12.2.3 up to 12.2.15. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure hosting Oracle Project Foundation. Successful exploitation can lead to complete compromise of the Oracle Project Foundation environment. The CVSS 3.1 vector indicates local attack vector with low attack complexity, requiring low privileges and no user interaction, and results in high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for this specific vulnerability. The vendor strongly recommends applying patches promptly to mitigate known vulnerabilities.

The vulnerability allows an attacker with low privileges and logon access to the Oracle Project Foundation infrastructure to fully compromise the product. This includes complete loss of confidentiality, integrity, and availability of the Oracle Project Foundation environment, potentially enabling takeover of the system.

Oracle has released a Critical Patch Update in July 2026 addressing numerous vulnerabilities across its product portfolio. Although the advisory does not explicitly confirm a patch for CVE-2026-61090, Oracle strongly recommends that customers apply the latest security patches without delay and remain on actively supported versions. Patch status for this specific vulnerability is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.