CVE-2026-60788 is a vulnerability in Oracle Sales Offline component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and the ability to cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) reflects network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact. The vulnerability is classified as high severity with a CVSS score of 8.3. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Sales Offline, unauthorized access to all data accessible by the product, and partial denial of service conditions. This impacts confidentiality, integrity, and availability of the affected system, potentially compromising business operations relying on Oracle Sales Offline data.

Oracle's July 2026 Critical Patch Update advisory includes numerous security patches and strongly recommends customers apply patches without delay and remain on actively supported versions. However, the advisory does not explicitly confirm a patch for CVE-2026-60788. Therefore, patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Until a patch is confirmed and applied, limit network access to Oracle Sales Offline interfaces to trusted users and monitor for unusual activity. Follow Oracle's official guidance for patching and mitigation.