This vulnerability (CVE-2026-60683) affects Oracle Process Manufacturing Regulatory Management, a component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise the product. The scope of impact may extend beyond this product to additional Oracle products. Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and no impact on integrity or availability. Oracle’s July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this vulnerability. The vendor strongly recommends applying security patches promptly to mitigate risks.

The vulnerability allows unauthorized access to critical data or complete access to all data accessible by Oracle Process Manufacturing Regulatory Management. The confidentiality impact is high, while integrity and availability are not affected. The vulnerability can be exploited remotely over the network with low privileges and no user interaction, increasing the risk of compromise. The scope of the vulnerability extends beyond the affected product, potentially impacting additional Oracle products.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle’s July 2026 Critical Patch Update advisory includes many patches and strongly recommends applying all relevant security patches without delay. Customers should remain on actively supported versions and monitor Oracle’s advisories for updates specific to this vulnerability.