CVE-2026-60340 is a vulnerability in the Oracle Project Costing product within Oracle E-Business Suite (component: Enterprise Command Center). It affects versions 12.2.3 through 12.2.15. The vulnerability allows a high privileged attacker with network access over HTTP to compromise the Oracle Project Costing system, potentially resulting in full system takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Project Costing, impacting confidentiality, integrity, and availability of the system. This could allow an attacker with high privileges and network access via HTTP to take over the affected component, potentially disrupting business operations and exposing sensitive project costing data.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. However, the advisory does not explicitly confirm a patch or remediation for CVE-2026-60340. Customers should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant patches without delay. Until a specific patch is confirmed, organizations should ensure that only trusted, high privileged users have network access to Oracle Project Costing and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.