This vulnerability affects Oracle Advanced Pricing within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low-privileged attacker with network access over HTTP to compromise the product, resulting in unauthorized access to critical data and partial unauthorized modification capabilities (update, insert, delete) on accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation status for this specific issue. Oracle recommends applying patches without delay to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized access to critical data within Oracle Advanced Pricing and unauthorized modification (update, insert, delete) of some accessible data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability is exploitable remotely over the network via HTTP by an attacker with low privileges, increasing the risk profile.

Oracle's July 2026 Critical Patch Update advisory includes security patches addressing multiple vulnerabilities, including this one. However, no explicit patch or remediation level is confirmed for CVE-2026-60870 in the provided advisory content. Customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant security updates promptly. Maintaining actively supported versions and timely patching is strongly recommended by Oracle to mitigate this vulnerability.