This vulnerability in Oracle Call Center Technology (component: RDBMS and UI) affects supported versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product by gaining unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and impacts on confidentiality and integrity but not availability. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references the July 2026 Critical Patch Update, which includes numerous patches across Oracle products. Oracle advises customers to remain on supported versions and apply patches without delay.

Successful exploitation allows unauthorized read access to some data and unauthorized modification (update, insert, delete) of some data within Oracle Call Center Technology. This compromises confidentiality and integrity of affected data but does not affect system availability. The attacker requires network access via HTTP and low privileges, making exploitation relatively straightforward.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to address vulnerabilities. Although no explicit patch for CVE-2026-61264 is detailed, customers should review the July 2026 CPU documentation and apply relevant patches for Oracle Call Center Technology versions 12.2.3 through 12.2.15. Until patches are applied, restrict network access to the affected service where possible. Monitor Oracle's security advisories for updates on remediation status.