This vulnerability exists in the Oracle Applications Framework component of Oracle E-Business Suite, specifically affecting the Graph / Charting module in supported versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to perform unauthorized actions such as creation, deletion, or modification of critical data within the framework. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability was published on July 21, 2026, and is listed in Oracle's July 2026 Critical Patch Update advisory, which includes a large set of security patches across Oracle products. The advisory recommends applying patches promptly but does not explicitly confirm a patch for this specific vulnerability in the provided content.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible via Oracle Applications Framework. This compromises confidentiality and integrity of the affected system's data. There is no indication of impact on availability. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay to address vulnerabilities, including this one. However, the provided advisory content does not explicitly confirm the availability of a patch or temporary fix specifically for CVE-2026-60768. Organizations should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is applied, restricting network access to Oracle Applications Framework interfaces and monitoring for suspicious activity may reduce risk.