This vulnerability in Oracle Complex Maintenance, Repair and Overhaul (Oracle E-Business Suite) versions 12.2.3 to 12.2.15 allows a low privileged attacker with network access via HTTP to gain unauthorized capabilities to create, delete, or modify critical data or gain full access to all data accessible by the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The vulnerability is easily exploitable. Oracle's July 2026 Critical Patch Update advisory includes security patches for multiple products, including Oracle E-Business Suite components, but does not explicitly confirm patch availability for this vulnerability. Customers are urged to review the advisory and apply patches without delay.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Oracle Complex Maintenance, Repair and Overhaul. This compromises confidentiality and integrity of critical business data. There is no reported impact on availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required.

Oracle has released a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities including those in Oracle E-Business Suite products. Although the advisory does not explicitly confirm patch availability for CVE-2026-60771, Oracle strongly recommends customers remain on actively-supported versions and apply security patches promptly. Users should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation information and apply relevant patches as soon as possible.