This vulnerability (CVE-2026-60828) exists in Oracle Interaction Blending within Oracle E-Business Suite, specifically affecting versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory references a July 2026 Critical Patch Update containing numerous patches across Oracle products but does not explicitly confirm a patch for this vulnerability. Patch status is therefore not yet confirmed and should be verified with the vendor advisory.

The vulnerability allows a high privileged attacker with network access via HTTP to fully compromise Oracle Interaction Blending, resulting in complete takeover. This impacts confidentiality, integrity, and availability of the affected product. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available. Until a patch is confirmed and applied, restrict network access to Oracle Interaction Blending to trusted users only and monitor for suspicious activity consistent with high privileged access attempts.