This vulnerability affects Oracle Contracts Integration versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Contracts Integration. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation level for this specific vulnerability. Customers are advised to review the advisory and apply patches promptly.

The vulnerability allows unauthorized creation, deletion, or modification of critical data within Oracle Contracts Integration, potentially compromising the confidentiality and integrity of all accessible data. This can lead to significant data breaches or manipulation within affected Oracle E-Business Suite environments. There is no impact on availability reported. No known exploits in the wild have been reported as of the advisory date.

Oracle has released a Critical Patch Update in July 2026 that addresses numerous vulnerabilities across Oracle products. Although the advisory does not explicitly confirm a patch for CVE-2026-61338, customers should promptly review the July 2026 Critical Patch Update advisory and apply all relevant patches for Oracle Contracts Integration versions 12.2.3 through 12.2.15. Maintaining up-to-date patch levels is strongly recommended to mitigate this vulnerability. Patch status is not yet confirmed explicitly for this CVE; check the vendor advisory for current remediation guidance.