This vulnerability in Oracle Enterprise Asset Management (component: Work Definition Issues) affects supported versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTPS to perform unauthorized read and write operations on some accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impacts. The vulnerability is tracked as CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability among many others but does not explicitly confirm a dedicated patch or remediation level for it. Customers are advised to apply Oracle Critical Patch Updates promptly to mitigate known vulnerabilities.

Successful exploitation can result in unauthorized update, insert, or delete access to some Oracle Enterprise Asset Management accessible data, as well as unauthorized read access to a subset of accessible data. There is no reported impact on system availability. The confidentiality and integrity impacts are limited but could affect data integrity and privacy within the affected component.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others. While no explicit patch or remediation level is confirmed for CVE-2026-60588 in the advisory, Oracle strongly recommends applying all relevant Critical Patch Updates without delay to address this and other vulnerabilities. Customers should remain on actively supported versions and follow Oracle's patching guidance. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.