This vulnerability affects Oracle EDI Gateway component of Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It allows an attacker with low privileges and network access over HTTP to gain unauthorized access that can result in creation, deletion, or modification of critical data. The CVSS 3.1 base score is 8.1, indicating high severity with high confidentiality and integrity impact and no impact on availability. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle EDI Gateway, compromising confidentiality and integrity of all accessible data. This could allow attackers to manipulate or access sensitive business data without authorization. There is no reported impact on system availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses numerous vulnerabilities across its product portfolio. However, the advisory does not explicitly confirm a patch or fix for CVE-2026-60710. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant patches promptly. Until a confirmed patch is applied, organizations should restrict network access to Oracle EDI Gateway to trusted users and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.