This vulnerability in Oracle Configure to Order (component: Supply to Order Workbench) allows a low privileged attacker with network access via HTTP to compromise the product, leading to unauthorized access to critical data or complete access to all data accessible by Oracle Configure to Order. The vulnerability has a CVSS 3.1 score of 7.7 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. The affected versions explicitly include 12.2.3 through 12.2.15. Oracle’s July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state patch availability or remediation level for this specific CVE. Customers are strongly advised to apply Oracle Critical Patch Updates promptly to mitigate risks.

Successful exploitation can lead to unauthorized access to critical data within Oracle Configure to Order, potentially exposing sensitive information. The vulnerability affects confidentiality with no direct impact on integrity or availability. The scope change indicates that other Oracle products may also be impacted indirectly by attacks exploiting this vulnerability.

Oracle’s July 2026 Critical Patch Update advisory includes this vulnerability among many others. However, the advisory does not explicitly confirm patch availability or provide a specific remediation level for CVE-2026-61125. Customers should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation information and apply all relevant security patches without delay. Until a patch is confirmed and applied, restrict network access to Oracle Configure to Order interfaces to trusted users only.