CVE-2026-60763 is a vulnerability in the Command Line - RapidClone component of Oracle Applications Manager within Oracle E-Business Suite. It affects supported versions from 12.2.3 to 12.2.15. The flaw allows an unauthenticated attacker who has logon access to the underlying infrastructure to compromise Oracle Applications Manager, potentially resulting in full takeover of the application. The CVSS 3.1 vector indicates local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for it. The advisory emphasizes the importance of applying patches without delay to mitigate exploitation risks.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Applications Manager, impacting confidentiality, integrity, and availability of the application. An attacker with local access to the infrastructure but no prior authentication can take over the Oracle Applications Manager component, potentially affecting the broader Oracle E-Business Suite environment.

Oracle's July 2026 Critical Patch Update advisory includes multiple security patches and strongly recommends customers apply these patches promptly. However, the advisory does not explicitly confirm a patch or remediation for CVE-2026-60763. Therefore, users should monitor Oracle's official security advisories and apply Critical Patch Updates as soon as they become available. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.