This vulnerability affects Oracle Price Protection component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It enables an attacker with low privileges and network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical or accessible data, and unauthorized read access to a subset of accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly state a patch for this specific vulnerability, so patch status is not confirmed.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible via Oracle Price Protection, as well as unauthorized read access to some data. This compromises data confidentiality and integrity, potentially affecting business operations relying on accurate price protection data. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. However, the advisory content provided does not explicitly confirm a patch or fix for CVE-2026-61334 in Oracle Price Protection. Therefore, patch status is not yet confirmed—check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance. Oracle strongly recommends applying all relevant security patches promptly once available and remaining on actively supported versions.