This vulnerability affects Oracle Application Object Library, a core component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is easily exploitable by unauthenticated attackers over the network via HTTP, enabling unauthorized access to sensitive data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact with no integrity or availability impact. Oracle has published a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities, including this one, but the specific patch status for this CVE is not explicitly stated in the advisory content provided.

Successful exploitation of this vulnerability can lead to unauthorized access to critical or all data accessible through Oracle Application Object Library. This compromises confidentiality but does not affect integrity or availability. The vulnerability is exploitable remotely without authentication, increasing the risk of data exposure in affected environments.

Oracle has released a Critical Patch Update in July 2026 that addresses numerous vulnerabilities across its product portfolio. Although the advisory does not explicitly confirm a patch for CVE-2026-61116, it is strongly recommended to review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches promptly. Customers should remain on actively supported versions and apply security patches without delay to mitigate this vulnerability. Patch status is not yet confirmed explicitly for this CVE; therefore, check the vendor advisory for current remediation guidance.