CVE-2026-60880 is an easily exploitable vulnerability in Oracle Work in Process (part of Oracle E-Business Suite Internal Operations) that allows an unauthenticated attacker with network access via HTTP to compromise the product. The vulnerability affects versions 12.2.3 through 12.2.15. Successful exploitation can result in complete takeover of Oracle Work in Process. The CVSS 3.1 score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm patch availability or remediation status for this vulnerability. Customers are urged to apply security patches without delay.

An unauthenticated attacker with network access via HTTP can fully compromise Oracle Work in Process, leading to complete takeover. This impacts confidentiality, integrity, and availability of the affected product. The critical severity and high CVSS score reflect the potential for severe damage if exploited.

Oracle has released a Critical Patch Update in July 2026 addressing multiple vulnerabilities. While the advisory does not explicitly confirm a patch for CVE-2026-60880, customers should promptly review and apply the July 2026 Critical Patch Update and any related patches for Oracle Work in Process. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. Patch status for this specific vulnerability is not yet confirmed; check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance.