This vulnerability affects Oracle Compensation Workbench component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the application, resulting in unauthorized access to critical data or complete access to all accessible data within the application. Additionally, the attacker can perform unauthorized modifications including update, insert, or delete operations on some data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly confirm patch availability for this specific vulnerability but strongly advises applying security patches without delay. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized disclosure of critical data and unauthorized modification (update, insert, delete) of some data within Oracle Compensation Workbench. This compromises confidentiality and integrity of the affected system's data. Availability is not impacted. The vulnerability requires network access and low privileges, making it relatively easy to exploit.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to address vulnerabilities including this one. However, no explicit patch or remediation level is stated for CVE-2026-60799 in the advisory. Organizations should monitor Oracle's security advisories and apply relevant patches as soon as they become available. Until patched, restrict network access to Oracle Compensation Workbench to trusted users only and consider additional access controls to limit exposure.