This vulnerability affects Oracle Cost Management component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is classified under CWE-284 (Improper Access Control). The vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Cost Management, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within Oracle Cost Management. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without affecting availability. The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly confirm a patch for this specific vulnerability but strongly recommends applying available patches without delay. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Cost Management, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the data but does not affect availability. The vulnerability requires network access via HTTP and low privileges, but has high attack complexity, making exploitation difficult.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to address vulnerabilities in Oracle products. Although no explicit patch or remediation level is stated for CVE-2026-60744, customers should review the advisory and apply any relevant patches for Oracle Cost Management versions 12.2.3 through 12.2.15 as soon as possible. No vendor advisory states that no action is required or that the issue is already mitigated. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.