This vulnerability affects Oracle Product Lifecycle Analytics 3.6.1 and allows an unauthenticated attacker to gain unauthorized access to critical data and cause partial denial of service via network access over HTTP. The vulnerability has a CVSS 3.1 score of 9.3 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, indicating it is remotely exploitable without privileges or user interaction, causes a confidentiality breach, and partial availability impact. The vulnerability may also affect other Oracle products due to scope change. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this specific vulnerability. Oracle strongly recommends applying available patches promptly to mitigate exploitation risks.

Successful exploitation results in unauthorized access to all data accessible by Oracle Product Lifecycle Analytics and can cause a partial denial of service. Confidentiality impact is high, while integrity impact is not affected. Availability impact is low but present. The vulnerability is exploitable remotely without authentication or user interaction, increasing risk.

Oracle's advisory does not explicitly confirm a patch or remediation level for CVE-2026-61175. Patch status is not yet confirmed — check the Oracle Critical Patch Update July 2026 advisory for current remediation guidance. Oracle recommends customers remain on actively supported versions and apply security patches without delay to mitigate exploitation risks.