CVE-2026-60764 is a vulnerability in the Oracle Financials Common Modules component of Oracle E-Business Suite, affecting supported versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the modules, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by these modules. The vulnerability has a CVSS 3.1 score of 8.1 with attack vector network, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Financials Common Modules, as well as unauthorized access to all data accessible by these modules. This compromises data confidentiality and integrity but does not impact availability. The vulnerability can be exploited remotely over the network by an attacker with low privileges and no user interaction is required.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities including those in Oracle Financials Common Modules. However, the advisory does not explicitly confirm patch availability or provide specific remediation instructions for CVE-2026-60764. Customers should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply all relevant security patches promptly. Until official patches are confirmed and applied, monitor Oracle's advisories for updates. No vendor statement indicates that no action is required or that the issue is already mitigated.