This vulnerability affects Oracle Mobile Application Server within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It is exploitable by a high privileged attacker over the network via HTTP without user interaction, allowing compromise of the server. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation status for this specific issue. Customers are urged to apply the Critical Patch Update without delay to address this and other vulnerabilities.

Successful exploitation can lead to complete compromise of Oracle Mobile Application Server, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the server, potentially leading to unauthorized data access, modification, or denial of service.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. While the advisory does not explicitly confirm the patch status for this specific vulnerability, it strongly recommends that customers apply the Critical Patch Update promptly to mitigate this and other vulnerabilities. Patch status is not yet confirmed explicitly for CVE-2026-60845; therefore, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance and patch availability.