CVE-2026-60691 affects Oracle Content Manager within Oracle E-Business Suite (component: Internal Operations) and is exploitable by a low privileged attacker over the network via HTTP. The vulnerability allows unauthorized creation, deletion, or modification of critical data or all accessible data in Oracle Content Manager. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. Affected versions explicitly include 12.2.3 through 12.2.15. Oracle's July 2026 Critical Patch Update advisory references multiple patches across products but does not explicitly confirm a patch for this CVE. Oracle recommends applying all relevant patches from the Critical Patch Update without delay to address such vulnerabilities.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Content Manager, as well as unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the data but does not impact system availability. The vulnerability can be exploited remotely by an attacker with low privileges and network access via HTTP.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses numerous security vulnerabilities across its product portfolio. Although the advisory does not explicitly confirm a patch for CVE-2026-60691, Oracle strongly recommends that customers apply the latest Critical Patch Updates promptly to mitigate this and other vulnerabilities. Customers should verify patch availability and installation instructions in the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. No vendor advisory states that no action is required or that the vulnerability is already mitigated without patching.