This vulnerability affects Oracle Supply Chain Globalization in Oracle E-Business Suite versions 12.2.3 to 12.2.15, specifically in the Copy Inventory Organization component. It permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized data modification (update, insert, delete), unauthorized data reading, and partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes multiple patches but does not explicitly confirm the availability of a patch for this vulnerability in the provided excerpt.

Successful exploitation allows unauthorized modification (update, insert, delete) and reading of some accessible data in Oracle Supply Chain Globalization, as well as the ability to cause a partial denial of service. The impact affects confidentiality, integrity, and availability to a low degree as per the CVSS score. The vulnerability requires network access and low privileges but no user interaction.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities across Oracle products. However, the provided advisory content does not explicitly confirm the availability of a patch or official fix for CVE-2026-61266. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, organizations should consider restricting network access to the affected Oracle Supply Chain Globalization component to trusted users only. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.