This vulnerability affects the Oracle Application Object Library component of Oracle E-Business Suite, specifically in the DB Privileges area. It permits a low privileged attacker with network access over HTTP to compromise the Oracle Application Object Library, potentially resulting in full takeover. The CVSS 3.1 base score is 7.5, indicating high severity, with impacts on confidentiality, integrity, and availability. The attack complexity is high, requiring no user interaction, and privileges required are low. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm patch availability or remediation level for this specific CVE.

Successful exploitation can lead to complete compromise of the Oracle Application Object Library, affecting confidentiality, integrity, and availability of the affected system. The attacker requires only low privileges and network access via HTTP, but the vulnerability is difficult to exploit due to high attack complexity.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm patch availability or remediation status for CVE-2026-61114. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply any relevant patches promptly. Until explicit patch information is confirmed, organizations should monitor Oracle advisories for updates. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.