This vulnerability in Oracle Contracts Integration version 12.2.3 allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or full access to all accessible data within Oracle Contracts Integration. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality and integrity impacts. The vendor advisory is part of the July 2026 Critical Patch Update, which includes numerous patches across Oracle products, but the advisory content does not explicitly confirm a patch for this CVE.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Oracle Contracts Integration. This compromises confidentiality and integrity of the affected system's data, potentially leading to significant business impact due to data manipulation or exposure.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities across its product portfolio. Customers are strongly advised to review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply relevant patches promptly. Patch status for CVE-2026-61338 is not explicitly confirmed in the advisory content provided; therefore, customers should verify patch availability and remediation instructions directly from Oracle's advisory. Maintaining actively supported versions and timely patch application is critical to mitigate this vulnerability.