This vulnerability affects Oracle Payables within Oracle E-Business Suite versions 12.2.8 through 12.2.15. It is easily exploitable by an attacker with low privileges who has network access via HTTP, enabling compromise and potential takeover of Oracle Payables. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle’s July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this vulnerability. Customers are urged to review the advisory and apply relevant patches promptly.

Successful exploitation can lead to complete compromise of Oracle Payables, impacting confidentiality, integrity, and availability of the affected system. This could allow an attacker to take over Oracle Payables functionality, potentially disrupting financial operations and exposing sensitive financial data.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. However, the advisory does not explicitly confirm a patch for CVE-2026-61320. Customers should consult the Oracle Critical Patch Update July 2026 advisory directly for patch availability and installation instructions. Until a patch is confirmed and applied, organizations should consider restricting network access to Oracle Payables and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.