This vulnerability affects Oracle Advanced Pricing component of Oracle E-Business Suite versions 12.2.14 and 12.2.15. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical data and unauthorized modification (update, insert, delete) of some Oracle Advanced Pricing accessible data. The vulnerability has a CVSS 3.1 score of 7.1 with network attack vector, high attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability for it individually. Customers are advised to apply the latest patches from Oracle's Critical Patch Update.

Successful exploitation can result in unauthorized access to critical data within Oracle Advanced Pricing and unauthorized modification of some data. The vulnerability affects confidentiality and integrity but not availability. Due to scope change, additional Oracle products may also be impacted by attacks leveraging this vulnerability.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. While the advisory does not explicitly confirm patch availability for CVE-2026-60868 individually, Oracle strongly recommends applying the latest Critical Patch Update patches without delay to remediate this and other vulnerabilities. Users should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch and installation instructions. No vendor advisory states that no action is required or that the issue is already mitigated, so patching is the recommended mitigation.