This vulnerability affects Oracle Cash Management component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to gain unauthorized capabilities to create, delete, or modify critical data within Oracle Cash Management. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability does not impact availability. Oracle's July 2026 Critical Patch Update advisory references security patches for multiple products but does not explicitly confirm patch availability or remediation level for this specific vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle Cash Management. This results in a high impact on confidentiality and integrity of the affected system's data. Availability is not impacted. The attacker requires only low privileges and network access via HTTP, making the vulnerability easily exploitable under the described conditions.

Oracle has released a Critical Patch Update in July 2026 that addresses numerous vulnerabilities across Oracle products. While the advisory includes Oracle Cash Management among affected products, it does not explicitly confirm patch availability or remediation status for CVE-2026-60740. Customers are strongly advised to review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply relevant patches promptly. Until official patches are confirmed and applied, no specific mitigation steps are provided by Oracle. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.