CVE-2026-61292 affects Oracle U.S. Federal Financials versions 12.2.3 through 12.2.15 and involves an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized read access to a subset of accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, and limited confidentiality impact without integrity or availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update mentions many patches but does not explicitly confirm a patch or remediation for this vulnerability, so patch status remains unconfirmed.

Successful exploitation results in unauthorized read access to some data within Oracle U.S. Federal Financials. The confidentiality impact is limited, with no impact on integrity or availability. This could lead to exposure of sensitive financial data accessible through the affected product versions.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected Oracle U.S. Federal Financials instances to trusted users only.