CVE-2026-60824 affects Oracle iSupport component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is an easily exploitable vulnerability that allows an attacker with low privileges and network access via HTTP to compromise the Oracle iSupport system. Successful exploitation can lead to unauthorized access to critical or all data accessible through Oracle iSupport. The vulnerability has a CVSS 3.1 score of 7.7 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and no integrity or availability impact. The Oracle July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this vulnerability. Oracle strongly recommends applying security patches promptly to mitigate risks.

The vulnerability allows unauthorized access to critical or all data accessible in Oracle iSupport, potentially compromising sensitive information. The scope change indicates that exploitation may impact additional Oracle products beyond iSupport. The confidentiality impact is high, while integrity and availability impacts are not affected. This could lead to significant data exposure within affected environments.

Oracle's July 2026 Critical Patch Update advisory includes multiple security patches across various products. However, the advisory does not explicitly confirm a patch or remediation level for CVE-2026-60824. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying all relevant security patches without delay and remaining on actively supported versions. Patch status for this vulnerability is not yet confirmed—check the vendor advisory for current remediation guidance.