This vulnerability affects the Oracle Applications Framework component of Oracle E-Business Suite, specifically the Search Bean (including Advanced) in supported versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the framework, resulting in unauthorized access to critical data or complete access to all data accessible via the framework. Additionally, the attacker may perform unauthorized data modification operations such as update, insert, or delete on some accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references the July 2026 Critical Patch Update containing numerous security patches and strongly urges customers to apply patches without delay.

Successful exploitation can lead to unauthorized access to critical and potentially all data accessible through Oracle Applications Framework. It also allows unauthorized modification (update, insert, delete) of some data, impacting confidentiality and integrity. There is no reported impact on availability. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to address this and other vulnerabilities. Although no explicit patch or remediation level is stated for CVE-2026-60774, customers should review the Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches for Oracle Applications Framework versions 12.2.3 through 12.2.15. Maintaining up-to-date supported versions and timely patching is the primary mitigation. No vendor advisory states that no action is required or that the issue is already mitigated.