This vulnerability (CVE-2026-60859) affects Oracle Quoting versions 12.2.3 to 12.2.15 within Oracle E-Business Suite. It allows a low privileged attacker with network access over HTTP to compromise Oracle Quoting, potentially leading to full takeover of the component. The attack complexity is high, requiring no user interaction, and the vulnerability impacts confidentiality, integrity, and availability. The CVSS vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H with a base score of 7.5. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly state that a patch is available for Oracle Quoting. No known exploits in the wild have been reported. Oracle recommends applying security patches promptly once released and staying on actively supported versions.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Quoting, impacting confidentiality, integrity, and availability of the affected system. An attacker with low privileges and network access via HTTP could take over the Oracle Quoting component, potentially allowing unauthorized access and control over its operations.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory and subsequent updates for current remediation guidance. Oracle strongly recommends applying security patches without delay once they become available and remaining on actively supported product versions. Until a patch is confirmed, monitor Oracle advisories for updates. No specific temporary mitigations are provided in the advisory.