This vulnerability affects the Collaboration History component of Oracle Supply Chain Trading Connector within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized access to sensitive or all accessible data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly mention a patch for this vulnerability, but Oracle strongly urges customers to apply available patches promptly to mitigate known vulnerabilities.

Successful exploitation can lead to unauthorized disclosure of critical or all data accessible by Oracle Supply Chain Trading Connector. There is no impact on data integrity or availability. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit. No known exploits have been reported in the wild at this time.

Oracle's July 2026 Critical Patch Update advisory does not explicitly confirm a patch for CVE-2026-60812. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends customers remain on actively-supported versions and apply security patches without delay to mitigate this and other vulnerabilities.