This vulnerability affects the Oracle Demand Signal Repository component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is easily exploitable by an attacker with low privileges and network access via SQL, enabling unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within the repository. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The vendor advisory from Oracle's July 2026 Critical Patch Update references a broad set of patches but does not explicitly confirm the patch availability or remediation level for this specific vulnerability. Oracle strongly recommends applying security patches promptly to mitigate risks.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the Oracle Demand Signal Repository. This compromises confidentiality and integrity of the data but does not affect system availability. The vulnerability requires network access and low privileges, making it relatively easy to exploit.

Oracle's July 2026 Critical Patch Update advisory includes multiple security patches and strongly recommends customers apply these patches without delay. However, the specific patch or remediation status for CVE-2026-60840 is not explicitly confirmed in the advisory. Therefore, patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Customers should remain on actively supported versions and apply Oracle Critical Patch Updates promptly to mitigate this and other vulnerabilities.