This vulnerability affects Oracle Financials Common Modules component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is exploitable over the network via HTTP by an attacker with low privileges, allowing unauthorized creation, deletion, or modification of critical data and unauthorized read access to some data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle advises customers to remain on supported versions and apply patches without delay.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Financials Common Modules, as well as unauthorized read access to a subset of accessible data. This compromises data integrity and confidentiality but does not affect availability. The vulnerability is exploitable remotely with low privileges and no user interaction, increasing risk.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to mitigate vulnerabilities. Although no explicit patch or remediation level is stated for CVE-2026-60772, customers should monitor the referenced Oracle advisory for patch availability and apply updates as soon as they are released. Until a patch is confirmed, restrict network access to Oracle Financials Common Modules where possible and follow Oracle's guidance on security updates.