This vulnerability affects Oracle Process Manufacturing Financials versions 12.2.3 to 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory references a July 2026 Critical Patch Update containing numerous patches but does not explicitly confirm a patch for this vulnerability. Patch status is therefore not confirmed and should be verified by consulting the vendor advisory directly.

The vulnerability enables unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Process Manufacturing Financials. This compromises confidentiality and integrity of sensitive business data. There is no impact on availability reported. The high CVSS score reflects the significant risk posed by this vulnerability if exploited.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. However, the advisory does not explicitly confirm a patch or remediation for CVE-2026-60708. Organizations should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, organizations should consider restricting network access to Oracle Process Manufacturing Financials and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.