This vulnerability affects Oracle Labor Distribution versions 12.2.3 to 12.2.15 and permits a low privileged attacker with network access via HTTP to compromise the product by gaining unauthorized update, insert, delete, and read access to some accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and limited confidentiality and integrity impacts without availability impact. The vendor advisory references a July 2026 Critical Patch Update containing numerous patches but does not explicitly confirm a patch for this specific vulnerability. Customers are advised to apply patches promptly as part of Oracle's cumulative security updates.

Successful exploitation allows unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through Oracle Labor Distribution. This compromises data confidentiality and integrity but does not affect availability. The attacker requires network access and low privileges, increasing the risk in environments where such access is possible.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. Although the advisory does not explicitly confirm a patch for CVE-2026-61200, customers should review the advisory and apply all relevant patches promptly to mitigate this vulnerability. Patch status is not yet confirmed specifically for this vulnerability; therefore, check the vendor advisory for current remediation guidance. No vendor statement indicates that no action is required or that the vulnerability is already mitigated.