This vulnerability affects Oracle Payroll component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the Oracle Payroll system, resulting in unauthorized access to critical or all accessible Oracle Payroll data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly confirm a patch for this specific vulnerability but advises applying the cumulative security patches included in the update. No known exploits in the wild have been reported at this time.

Successful exploitation allows unauthorized access to critical data within Oracle Payroll, potentially exposing sensitive payroll information. The vulnerability affects confidentiality but does not impact integrity or availability. Due to scope change, exploitation may also affect other Oracle products integrated with Oracle Payroll. The high CVSS score (7.7) reflects the significant risk posed by this vulnerability if left unmitigated.

Oracle has released a Critical Patch Update in July 2026 that includes numerous security fixes. Although the vendor advisory does not explicitly confirm a patch for CVE-2026-60750, Oracle strongly recommends that customers apply the latest Critical Patch Updates without delay to address this and other vulnerabilities. There is no indication that the vulnerability is already mitigated or requires no action. Organizations should verify patch availability and apply relevant updates from Oracle's official security alerts. Since this is not a cloud service, remediation depends on customer action to apply patches.