This vulnerability affects Oracle Application Object Library component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the application, resulting in unauthorized ability to read, update, insert, or delete some accessible data and to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle strongly recommends applying available patches without delay to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized read access to some data, unauthorized modification (update, insert, delete) of some data within Oracle Application Object Library, and the ability to cause a partial denial of service. This impacts confidentiality, integrity, and availability to a limited extent as reflected by the CVSS score of 6.3.

Oracle's advisory for the July 2026 Critical Patch Update recommends applying security patches promptly. However, the vendor advisory does not explicitly confirm a patch for CVE-2026-60777 at this time. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Customers should remain on actively supported versions and apply Oracle Critical Patch Updates without delay to mitigate this and other vulnerabilities.