This vulnerability (CVE-2026-60862) affects Oracle Order Management within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is classified under CWE-284 (Improper Access Control) and allows a high privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope change, high confidentiality impact, no integrity or availability impact. The Oracle Critical Patch Update advisory from July 2026 references multiple vulnerabilities and patches but does not explicitly confirm a patch for this CVE in the provided excerpt. No known exploits in the wild have been reported.

Successful exploitation allows a high privileged attacker with network access to gain unauthorized access to critical or all data accessible by Oracle Order Management. The vulnerability impacts confidentiality significantly but does not affect integrity or availability. Additionally, the vulnerability's scope change means it may impact other Oracle products beyond Oracle Order Management.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Order Management interfaces to trusted users with high privileges to reduce exposure.