CVE-2026-60806 is a vulnerability in the Costing Transaction Errors component of Oracle Cost Management within Oracle E-Business Suite. It affects supported versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to compromise Oracle Cost Management, potentially resulting in takeover of the product. The vulnerability is rated with a CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high impact on confidentiality, integrity, and availability. Oracle has published this issue in their July 2026 Critical Patch Update advisory, which includes multiple patches across Oracle products. The advisory strongly urges customers to apply patches without delay to mitigate exploitation risks.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Cost Management, including unauthorized access and control over the product. The impacts affect confidentiality, integrity, and availability, potentially allowing an attacker to take over the affected system. The vulnerability requires network access via HTTP and low privileges but is considered difficult to exploit.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. Customers are strongly recommended to apply the relevant security patches from this update promptly. No specific temporary mitigations are indicated. Patch status is not explicitly confirmed in the advisory text provided, but the presence in the Critical Patch Update strongly implies an official fix is available. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions.