This vulnerability affects Oracle Product Workbench, a component of Oracle E-Business Suite (Internal Operations), in versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to gain unauthorized access that can lead to creation, deletion, or modification of critical data within the product. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The vulnerability is easily exploitable and does not require user interaction. Oracle's July 2026 Critical Patch Update advisory references security patches for multiple products but does not explicitly confirm the patch status for this specific vulnerability. Customers are strongly advised to apply Oracle patches promptly as per the advisory.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle Product Workbench. It compromises confidentiality and integrity of the data but does not affect system availability. The attacker requires only low privileges and network access via HTTP, making the vulnerability easily exploitable.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay to address vulnerabilities including this one. However, the advisory does not explicitly confirm the availability of a specific patch for CVE-2026-61333. Therefore, patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Customers should remain on actively supported versions and apply all relevant security updates promptly.