This vulnerability (CVE-2026-60755) affects Oracle Assets versions 12.2.3 through 12.2.15 within Oracle E-Business Suite. It allows a high privileged attacker with network access via HTTP to compromise the Oracle Assets component, potentially resulting in full system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state patch availability or remediation details for this specific CVE. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Assets, impacting confidentiality, integrity, and availability of the system. This could allow an attacker with high privileges and network access to take over Oracle Assets, potentially affecting business operations relying on this component.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others. While the advisory does not explicitly confirm patch availability for CVE-2026-60755, Oracle strongly recommends applying all relevant Critical Patch Updates without delay to mitigate this and other vulnerabilities. Customers should verify patch availability and installation instructions in the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. No alternative or temporary mitigations are specified.