CVE-2026-61301 affects Oracle Process Manufacturing Financials versions 12.2.3 to 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the system. The vulnerability enables unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within Oracle Process Manufacturing Financials. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. Oracle's July 2026 Critical Patch Update advisory includes security patches for multiple products but does not explicitly confirm patch availability for this specific vulnerability. Customers are urged to remain on supported versions and apply patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Process Manufacturing Financials. It also allows unauthorized access to critical or all accessible data in the product, compromising confidentiality and integrity. There is no reported impact on availability. The vulnerability is exploitable remotely over the network via HTTP by an attacker with low privileges, increasing the risk of compromise.

Oracle's July 2026 Critical Patch Update advisory addresses numerous vulnerabilities across Oracle products. Although the advisory does not explicitly confirm a patch for CVE-2026-61301, Oracle strongly recommends customers apply all relevant security patches promptly and remain on actively supported versions. Organizations using Oracle Process Manufacturing Financials versions 12.2.3 through 12.2.15 should monitor Oracle's advisory for patch availability and apply updates as soon as they are released. Until patches are applied, restrict network access to the affected service where possible to reduce exposure.