This vulnerability affects Oracle EDI Gateway within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It is classified under CWE-284 (Improper Access Control). An unauthenticated attacker with network access via HTTP could exploit this vulnerability to compromise the Oracle EDI Gateway, potentially resulting in full takeover. The CVSS 3.1 base score is 8.1, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability is described as difficult to exploit. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes numerous patches across Oracle products, but the advisory text does not explicitly confirm a patch for this specific vulnerability.

Successful exploitation can lead to complete compromise of the Oracle EDI Gateway, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected system without authentication, posing a significant risk to organizations using vulnerable versions.

Oracle has included this vulnerability in their July 2026 Critical Patch Update advisory. However, the advisory content provided does not explicitly confirm the availability of a patch for CVE-2026-60756. Customers are strongly advised to review the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant patches promptly. Until a patch is confirmed and applied, organizations should restrict network access to Oracle EDI Gateway instances and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.