This vulnerability affects Oracle Cost Management (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Cost Management. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The vulnerability is identified as CWE-284 (Improper Access Control). The vendor advisory from Oracle's July 2026 Critical Patch Update references multiple patches but does not explicitly confirm a patch for this specific vulnerability. Oracle recommends applying security patches without delay to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Cost Management, as well as unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the data but does not impact availability. The vulnerability can be exploited remotely by an attacker with low privileges and network access via HTTP.

Oracle's July 2026 Critical Patch Update advisory does not explicitly confirm a patch for CVE-2026-60741 but strongly recommends applying all available security patches promptly. Since no specific remediation level or patch is stated, users should monitor Oracle's advisory for updates and apply the latest Critical Patch Updates to mitigate this vulnerability. No vendor guidance indicates that no action is required or that the issue is already mitigated.