This vulnerability affects Oracle E-Business Suite Integrated SOA Gateway (component: Web Service Provider) in versions 12.2.3 to 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the system, leading to unauthorized data manipulation (update, insert, delete), unauthorized data reading, and the ability to cause a partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle strongly advises applying available patches promptly to mitigate such vulnerabilities.

Successful exploitation can result in unauthorized update, insertion, or deletion of some accessible data within Oracle E-Business Suite Integrated SOA Gateway, unauthorized read access to a subset of accessible data, and the ability to cause a partial denial of service affecting availability. The impact affects confidentiality, integrity, and availability but is rated medium severity with a CVSS score of 6.3.

Oracle's July 2026 Critical Patch Update advisory recommends that customers apply security patches without delay to address vulnerabilities including this one. However, no explicit patch or remediation level is confirmed for CVE-2026-60572 in the advisory content provided. Organizations should monitor Oracle's official security alerts and apply relevant Critical Patch Updates as soon as they become available. Until a patch is confirmed, consider restricting network access to the affected component and applying compensating controls where feasible.