This vulnerability in Oracle Process Manufacturing Systems (version 12.2.3) allows an attacker with low privileges and network access via HTTP to perform unauthorized actions on critical data, including creation, deletion, and modification. The CVSS 3.1 score is 8.1, reflecting high confidentiality and integrity impacts. The vulnerability is publicly disclosed and documented in Oracle's July 2026 Critical Patch Update advisory, which includes numerous security patches across Oracle products. However, the advisory does not explicitly confirm a patch for this specific vulnerability, and no direct patch links are provided in the input data.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Process Manufacturing Systems, resulting in significant confidentiality and integrity breaches. There is no impact on availability. The attacker requires network access via HTTP and low privileges, making exploitation relatively easy under these conditions.

Oracle recommends applying security patches from the July 2026 Critical Patch Update without delay. Although the advisory covers many vulnerabilities, patch status for CVE-2026-61287 is not explicitly confirmed; therefore, users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation information. Until a patch is applied, restrict network access to Oracle Process Manufacturing Systems to trusted users and monitor for suspicious activity related to unauthorized data changes.