This vulnerability in Oracle Order Management's Product Diagnostic Tools component allows a high privileged attacker with network access via HTTP to compromise the system. The CVSS 3.1 base score is 7.2, indicating high severity with impacts on confidentiality, integrity, and availability. The affected versions explicitly include 12.2.3 and extend through 12.2.15. Oracle's July 2026 Critical Patch Update advisory references a large set of security patches across many products but does not explicitly confirm a patch for this specific CVE in the provided content. The vulnerability is classified under CWE-284 (Improper Access Control).

Successful exploitation can lead to complete compromise of Oracle Order Management, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access and control over business-critical order management functions.

Oracle has released a Critical Patch Update in July 2026 addressing numerous vulnerabilities across its product portfolio. Customers are strongly advised to apply the latest patches promptly and remain on actively supported versions. However, the provided advisory content does not explicitly confirm a patch for CVE-2026-61115. Therefore, patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Until a patch is confirmed and applied, limit network access to Oracle Order Management to trusted users and monitor for suspicious activity.