This vulnerability affects Oracle Order Management component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It enables a high privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 score of 6.8 with a vector indicating network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which addresses numerous vulnerabilities across Oracle products. However, the advisory content does not explicitly confirm whether a patch for CVE-2026-60862 is included or available, nor does it provide specific mitigation instructions for this vulnerability.

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible by Oracle Order Management. The confidentiality of sensitive information is at risk, but integrity and availability impacts are not indicated. The vulnerability may also affect additional Oracle products due to scope change, potentially broadening the impact beyond Oracle Order Management itself.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to address vulnerabilities. Until explicit patch information is confirmed, organizations should ensure they are running supported versions and monitor Oracle advisories for updates. No vendor advisory states that no action is required or that the vulnerability is already mitigated.