This vulnerability affects Oracle Advanced Outbound Telephony within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product, resulting in potential full takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes numerous patches across Oracle products, but does not explicitly state the patch status for this vulnerability. No known exploits in the wild have been reported at this time.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Advanced Outbound Telephony, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access, data disclosure, and disruption of telephony operations.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities across its product portfolio. Although the advisory does not explicitly confirm a patch for CVE-2026-60829, customers are strongly recommended to apply the latest Oracle Critical Patch Update promptly to mitigate this vulnerability. Patch status is not explicitly confirmed in the advisory; therefore, customers should consult the Oracle Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. No vendor statement indicates that no action is required or that the vulnerability is already mitigated.