This vulnerability affects Oracle Application Object Library versions 12.2.3 through 12.2.15. It is an easily exploitable flaw that allows a low privileged attacker who has logon access to the infrastructure to compromise the Oracle Application Object Library. The vulnerability impacts confidentiality by potentially allowing unauthorized access to critical data or full access to all data accessible by the Oracle Application Object Library. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, no integrity or availability impact. The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly state a patch for this specific CVE but strongly urges customers to apply available patches promptly. The vulnerability may also affect other Oracle products due to scope change.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by the Oracle Application Object Library. This confidentiality impact can compromise sensitive information within Oracle E-Business Suite environments. The vulnerability requires local access with low privileges but no user interaction, and the scope of impact extends beyond the Oracle Application Object Library component to other Oracle products.

Oracle's July 2026 Critical Patch Update advisory strongly recommends that customers remain on actively-supported versions and apply security patches without delay. Although no explicit patch or remediation level is stated for CVE-2026-61111 in the advisory, applying the latest Critical Patch Update is the recommended mitigation. Customers should review the linked Oracle advisory for patch availability and installation instructions. No vendor advisory states that no action is required or that the vulnerability is already mitigated.