This vulnerability affects Oracle Compensation Workbench component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is exploitable remotely over the network via HTTP by an attacker with low privileges and no user interaction required. Successful exploitation can lead to unauthorized access to critical and all accessible data within the product, as well as unauthorized modification (update, insert, delete) of some data. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory references a Critical Patch Update released in July 2026 addressing numerous vulnerabilities but does not explicitly confirm the patch availability or remediation level for this specific CVE. No known exploits in the wild have been reported at this time.

The vulnerability allows unauthorized access to critical and all accessible data within Oracle Compensation Workbench, potentially compromising confidentiality. It also permits unauthorized modification of some data, impacting data integrity. There is no impact on availability reported. The CVSS score of 7.1 reflects a high severity due to the significant confidentiality and integrity impacts. The vulnerability can be exploited remotely by a low privileged attacker without user interaction, increasing the risk of compromise if the system is exposed to untrusted networks.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory, which contains numerous security patches across Oracle products. However, the vendor advisory does not explicitly confirm the availability of a specific patch or remediation level for CVE-2026-60799. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Applying the relevant patches promptly is recommended to mitigate this vulnerability. Since this is not a cloud service, remediation depends on customer action. Patch status is not yet confirmed explicitly; therefore, check the vendor advisory for current remediation guidance.