This vulnerability affects Oracle Application Object Library component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is a difficult to exploit vulnerability that allows a low privileged attacker with network access via HTTP to compromise the Oracle Application Object Library, potentially resulting in full takeover of the component. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability (7.5 base score). The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly confirm a patch for this specific vulnerability but strongly urges customers to apply available security patches without delay. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to complete compromise of the Oracle Application Object Library component, impacting confidentiality, integrity, and availability of the affected system. This could allow an attacker to take over the component, potentially leading to unauthorized access and control within Oracle E-Business Suite environments.

Oracle has not explicitly stated a specific patch or remediation level for CVE-2026-60770 in the provided advisory. However, Oracle strongly recommends that customers remain on actively supported versions and apply Critical Patch Updates promptly to mitigate vulnerabilities. Users should monitor Oracle's official security alerts and apply any relevant patches as soon as they become available. Patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.