This vulnerability affects Oracle Enterprise Asset Management component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is classified under CWE-284 (Improper Access Control). The issue allows a high privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or full access to all accessible data within Oracle Enterprise Asset Management. The CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, required high privileges, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly mention a dedicated patch for this vulnerability but strongly recommends applying all relevant security patches from the update. No known exploits have been reported in the wild.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Oracle Enterprise Asset Management. This compromises confidentiality and integrity of the affected system's data. The vulnerability requires a high privileged attacker with network access, making exploitation difficult but impactful if achieved. There is no impact on availability.

Oracle's July 2026 Critical Patch Update advisory recommends that customers apply the latest security patches promptly. Although no specific patch for CVE-2026-60695 is explicitly detailed, Oracle's general guidance is to remain on actively supported versions and apply all available patches without delay. Patch status is not yet confirmed specifically for this vulnerability; therefore, users should monitor Oracle's advisory for updates and apply relevant Critical Patch Updates as they become available.