This vulnerability affects Oracle HCM Configuration Workbench component Spreadsheet Loading in Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is exploitable remotely without authentication over HTTP, allowing unauthorized access to modify or read some data and cause partial denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes many patches, but it does not explicitly state the patch status for this vulnerability. Customers are urged to apply security patches promptly as per Oracle's general guidance.

Successful exploitation can lead to unauthorized update, insertion, or deletion of some accessible data in Oracle HCM Configuration Workbench, unauthorized read access to a subset of data, and the ability to cause a partial denial of service. This impacts confidentiality, integrity, and availability of the affected system. The vulnerability is remotely exploitable without authentication, increasing risk.

Oracle's July 2026 Critical Patch Update advisory includes security patches addressing multiple vulnerabilities. Although the advisory does not explicitly confirm a patch for CVE-2026-61267, Oracle strongly recommends applying the latest Critical Patch Update without delay to mitigate this and other vulnerabilities. Customers should verify patch availability and installation instructions via Oracle's official security alerts page. No vendor advisory states that no action is required or that the vulnerability is already mitigated.