This vulnerability affects Oracle Process Manufacturing Regulatory Management component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is an easily exploitable vulnerability that allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in potential full takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory references a July 2026 Critical Patch Update containing numerous patches, but does not explicitly confirm a patch for this specific CVE. Customers are strongly advised to apply available patches promptly as per Oracle's general guidance.

Successful exploitation can lead to complete compromise of Oracle Process Manufacturing Regulatory Management, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially leading to unauthorized access and control over sensitive regulatory management operations.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay and remaining on actively-supported versions. However, the advisory does not explicitly confirm a patch for CVE-2026-60681. Therefore, patch status is not yet confirmed—check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance. Until a patch is confirmed and applied, limit network exposure of Oracle Process Manufacturing Regulatory Management and monitor for unusual activity.