CVE-2026-61271 affects Oracle Document Management and Collaboration versions 12.2.3. It is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized update, insert, or delete access to some accessible data, unauthorized read access to a subset of data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes multiple patches across products but does not explicitly state the patch status for this vulnerability. Users are strongly recommended to review the advisory and apply relevant patches promptly.

The vulnerability allows unauthenticated remote attackers to gain unauthorized read and write access to some data within Oracle Document Management and Collaboration, potentially leading to data manipulation and partial denial of service. This impacts confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported, but the vulnerability is considered easily exploitable.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities including this one. However, the advisory does not explicitly confirm patch availability or remediation status for CVE-2026-61271. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply all relevant security patches without delay. Until patches are applied, restrict network access to the affected Oracle Document Management and Collaboration service where possible.