This vulnerability affects Oracle Product Hub within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to perform unauthorized actions on critical data, including creation, deletion, and modification. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability does not impact availability. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for this specific vulnerability. The vendor strongly recommends applying security patches promptly to mitigate exploitation risks.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Product Hub, as well as unauthorized access to all accessible data. This compromises data confidentiality and integrity but does not affect system availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required, increasing the risk of compromise.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to address vulnerabilities in Oracle products. However, the advisory content provided does not explicitly confirm a patch or workaround for CVE-2026-61310. Therefore, patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Until a patch is confirmed and applied, restrict network access to Oracle Product Hub instances and monitor for suspicious activity related to unauthorized data access or modification.