CVE-2026-60675 is a vulnerability in the Search Bean component of Oracle Applications Framework within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the framework, potentially resulting in full takeover. The vulnerability is rated with a CVSS 3.1 score of 8.8, reflecting high impact across confidentiality, integrity, and availability. The vulnerability is included in Oracle's July 2026 Critical Patch Update, which addresses 1449 security issues across various Oracle products. The vendor advisory emphasizes the importance of applying patches without delay but does not explicitly state the patch status for this vulnerability in the provided excerpt.

Successful exploitation of CVE-2026-60675 can lead to complete compromise of the Oracle Applications Framework, affecting confidentiality, integrity, and availability of the affected system. This could allow an attacker to take over the framework with low privileges and network access via HTTP.

Oracle has released a Critical Patch Update in July 2026 that includes security patches addressing this and other vulnerabilities. Customers are strongly advised to apply the relevant patches from this update promptly. Patch status for this specific vulnerability is not explicitly confirmed in the advisory excerpt provided; therefore, verify patch availability and installation instructions at the official Oracle advisory: https://www.oracle.com/security-alerts/cpujul2026.html. Maintaining up-to-date patched versions is the primary mitigation.