This vulnerability affects Oracle Risk Management component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to perform unauthorized actions such as creating, deleting, or modifying critical data. The CVSS 3.1 base score is 8.1, indicating high severity with high confidentiality and integrity impacts and no impact on availability. The vulnerability is publicly disclosed and listed in Oracle's July 2026 Critical Patch Update advisory, which contains numerous patches for various Oracle products. However, the advisory does not explicitly confirm the availability of a patch for this vulnerability, so users must verify patch availability directly from Oracle's advisory.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data within Oracle Risk Management, compromising confidentiality and integrity of all accessible data. This could lead to significant data breaches or manipulation of critical business information. There is no reported impact on system availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities across its product portfolio. Users of Oracle Risk Management versions 12.2.3 through 12.2.15 should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Patch status for CVE-2026-60871 is not explicitly confirmed; therefore, users must verify the current remediation status from the vendor advisory and apply patches promptly if available. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions.