This vulnerability affects Oracle Applications DBA within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is easily exploitable by an attacker with low privileges who can access the system over HTTP, enabling compromise and potential takeover of the Oracle Applications DBA. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The July 2026 Oracle Critical Patch Update advisory references multiple patches across Oracle products but does not explicitly confirm a patch for this specific vulnerability. Customers are urged to review the advisory and apply relevant patches without delay.

Successful exploitation can lead to complete compromise of Oracle Applications DBA, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected Oracle Applications DBA environment, potentially leading to unauthorized access and control over sensitive business application data and operations.

Oracle has released a Critical Patch Update in July 2026 that addresses numerous vulnerabilities across its product portfolio. Although the advisory does not explicitly confirm a patch for CVE-2026-61110, Oracle strongly recommends that customers remain on actively supported versions and apply all relevant security patches promptly. Users of Oracle Applications DBA versions 12.2.3 through 12.2.15 should consult the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions to mitigate this vulnerability.