This vulnerability affects Oracle General Ledger within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It involves insufficient authorization controls (CWE-306, CWE-287, CWE-269) that allow a low privileged attacker with network access via SOAP to compromise the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple vulnerabilities and patches but does not explicitly confirm a patch for this vulnerability in the provided excerpt. No known exploits in the wild have been reported at this time.

Successful exploitation of this vulnerability can result in complete takeover of Oracle General Ledger, affecting confidentiality, integrity, and availability of the system. This could allow unauthorized access to sensitive financial data and disruption of ledger operations.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities. However, the provided advisory content does not explicitly confirm the availability of a patch for CVE-2026-60678. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant patches promptly. Until a patch is confirmed and applied, restrict network access to Oracle General Ledger SOAP interfaces to trusted users only and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.