This vulnerability affects Oracle E-Business Intelligence component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is difficult to exploit and requires a high privileged attacker with network access via HTTP. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle E-Business Intelligence. The CVSS vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update mentions multiple patches across products but does not explicitly confirm the patch status for this specific vulnerability. Users are advised to review the advisory and apply relevant patches promptly.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle E-Business Intelligence. This impacts confidentiality and integrity of the data but does not affect availability. The vulnerability requires a high privileged attacker with network access, making exploitation difficult.

Oracle has released a Critical Patch Update in July 2026 that addresses numerous vulnerabilities across its product portfolio, including Oracle E-Business Intelligence. Although the specific patch for CVE-2026-60801 is not explicitly confirmed in the advisory, customers are strongly recommended to remain on actively supported versions and apply the latest security patches without delay. Patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.