This vulnerability affects Oracle Knowledge Management component of Oracle E-Business Suite, specifically versions 12.2.5 through 12.2.15. It allows an unauthenticated attacker with network access via HTTP to exploit the system, requiring user interaction from a third party. The attack can result in unauthorized modification (update, insert, delete) and unauthorized reading of some accessible data within Oracle Knowledge Management. The vulnerability has a CVSS 3.1 score of 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts. The vendor advisory from Oracle does not explicitly confirm a patch availability for this specific vulnerability but advises applying Critical Patch Updates regularly. The vulnerability is associated with CWE-601 (URL Redirection), CWE-352 (Cross-Site Request Forgery), and CWE-285 (Improper Authorization).

Successful exploitation can lead to unauthorized update, insert, or delete operations on some Oracle Knowledge Management data, as well as unauthorized read access to a subset of that data. This compromises confidentiality and integrity of the affected data but does not impact availability. The vulnerability requires user interaction from a person other than the attacker and network access via HTTP. The scope of impact may extend beyond Oracle Knowledge Management to additional Oracle products.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and remaining on actively supported versions. No specific patch or temporary fix for CVE-2026-60842 is explicitly stated in the advisory as of the publication date. Until a patch is available, organizations should be aware of the requirement for user interaction in exploitation and consider mitigating risks related to social engineering and HTTP access controls.