This vulnerability affects the Internal Operations component of Oracle Lease and Finance Management within Oracle E-Business Suite, specifically versions 12.2.11 through 12.2.15. It permits a low privileged attacker with network access over HTTP to compromise the product, potentially leading to full takeover. The CVSS 3.1 base score is 7.5, indicating high severity with impacts to confidentiality, integrity, and availability. The attack complexity is high, requiring no user interaction but low privileges. Oracle's July 2026 Critical Patch Update advisory lists many patched vulnerabilities but does not explicitly confirm a patch for this CVE. The vendor strongly recommends applying available patches promptly to mitigate risks.

Successful exploitation can lead to complete compromise of Oracle Lease and Finance Management, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access and control over sensitive financial operations.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay to address vulnerabilities in Oracle products. However, the advisory does not explicitly confirm a patch for CVE-2026-61337. Therefore, patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a patch is confirmed and applied, organizations should restrict network access to Oracle Lease and Finance Management instances and monitor for suspicious activity consistent with exploitation attempts.