This vulnerability exists in Oracle Complex Maintenance, Repair and Overhaul versions 12.2.3 to 12.2.15. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially leading to unauthorized access to critical data and limited unauthorized data modification (update, insert, delete). The vulnerability has a CVSS 3.1 score of 7.5 with vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N, indicating network attack vector, high attack complexity, no privileges or user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact. Attacks may also affect additional Oracle products due to scope change. Oracle has published this vulnerability in their July 2026 Critical Patch Update advisory but has not explicitly confirmed patch availability or remediation status for this specific issue. The vendor strongly recommends applying security patches promptly to mitigate risks.

Successful exploitation can result in unauthorized access to critical data within Oracle Complex Maintenance, Repair and Overhaul and unauthorized update, insert, or delete operations on some accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that other Oracle products may also be affected indirectly. No known exploits in the wild have been reported at this time.

Oracle has included this vulnerability in their July 2026 Critical Patch Update advisory. However, the vendor advisory does not explicitly confirm the availability of a specific patch or fix for CVE-2026-61138. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant security patches promptly. Maintaining actively supported versions and timely patching is critical to mitigating this vulnerability. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.