This vulnerability in Oracle Assets (component: Internal Operations) of Oracle E-Business Suite affects supported versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to perform unauthorized actions on critical data, including creation, deletion, or modification, resulting in full compromise of accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update strongly encourages applying available patches but does not explicitly confirm a patch for this specific vulnerability in the provided excerpt.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Assets, as well as unauthorized access to all data accessible by Oracle Assets. This compromises confidentiality and integrity of the data, potentially affecting business operations relying on this data. There is no reported impact on availability. No known exploits in the wild have been reported so far.

Oracle's July 2026 Critical Patch Update advisory recommends that customers apply security patches without delay to address vulnerabilities including this one. Although no explicit patch or remediation level is stated for CVE-2026-60749 in the provided advisory content, the general guidance is to remain on actively supported versions and promptly apply Oracle Critical Patch Updates. Patch status is not yet confirmed specifically for this vulnerability—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.