This vulnerability (CVE-2026-60806) affects Oracle Cost Management component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It involves a security flaw in the Costing Transaction Errors component that can be exploited remotely over HTTP by a low privileged attacker. The attack complexity is high, and no user interaction is required. Successful exploitation could lead to full compromise (takeover) of Oracle Cost Management, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H with a base score of 7.5. The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly confirm a patch or remediation level for this specific vulnerability, but strongly urges customers to apply available patches and remain on supported versions.

Successful exploitation of this vulnerability can result in complete takeover of Oracle Cost Management, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to access sensitive data, modify or disrupt costing transactions, and potentially impact business operations relying on Oracle Cost Management.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends customers remain on actively-supported versions and apply security patches without delay. Since no explicit patch or temporary fix is stated for this vulnerability in the advisory, monitoring Oracle's Critical Patch Updates for a fix is advised.