CVE-2026-60886 is a vulnerability in Oracle Work in Process versions 12.2.3 to 12.2.15 that allows a low privileged attacker with network access over HTTP to compromise the product. Exploitation requires human interaction from a user other than the attacker and can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on some data. The vulnerability affects confidentiality and integrity with a CVSS 3.1 score of 7.6 and involves a scope change potentially impacting additional Oracle products. Oracle’s July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data within Oracle Work in Process and unauthorized modification (update, insert, delete) of some data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates potential impact on additional Oracle products beyond Oracle Work in Process.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly to mitigate vulnerabilities. Until a specific patch is confirmed, organizations should follow Oracle’s security recommendations and monitor for updates. No vendor advisory states that no action is required or that the issue is already mitigated.