This vulnerability affects Oracle Product Workbench, a component of Oracle E-Business Suite Internal Operations, in versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Product Workbench. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The vulnerability is classified under CWE-284 (Improper Access Control). The Oracle Critical Patch Update advisory for July 2026 mentions multiple patches but does not explicitly confirm a fix for this specific vulnerability in the provided excerpt.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Product Workbench, or unauthorized access to all data accessible by the product. This compromises data confidentiality and integrity but does not affect system availability. The vulnerability can be exploited remotely over the network via HTTP by an attacker with low privileges, increasing the risk of significant data compromise.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities across Oracle products. However, the provided advisory content does not explicitly confirm the availability of a patch or fix for CVE-2026-61335. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, organizations should consider restricting network access to Oracle Product Workbench instances to trusted users only and monitor for suspicious activity related to unauthorized data access or modification.