This vulnerability affects Oracle Product Workbench versions 12.2.3 to 12.2.15 and allows an attacker with low privileges and network access over HTTP to compromise the product. Successful exploitation can lead to unauthorized data manipulation (update, insert, delete), unauthorized reading of some data, and partial denial of service conditions. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. The vendor advisory is a general Critical Patch Update notice listing many patched products but does not explicitly confirm a patch for this vulnerability. Patch status is therefore not yet confirmed and should be verified with Oracle's official advisory.

An attacker with network access and low privileges can exploit this vulnerability to gain unauthorized read and write access to some data within Oracle Product Workbench, potentially modifying or deleting data without authorization. Additionally, the attacker can cause a partial denial of service affecting availability of the product. The impact affects confidentiality, integrity, and availability but is rated as low impact on each according to CVSS 3.1 metrics.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities across many products. However, the advisory content provided does not explicitly confirm the availability of a patch or fix for CVE-2026-61269. Customers should consult the Oracle Critical Patch Update July 2026 advisory directly at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, restrict network access to Oracle Product Workbench to trusted users only and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.