This vulnerability in Oracle Work in Process (component: Internal Operations) affects supported versions 12.2.3 through 12.2.15. It is difficult to exploit and requires network access via HTTP with low privileges. Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Work in Process. The CVSS 3.1 vector indicates network attack vector (AV:N), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), and no impact on integrity or availability (I:N, A:N). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for this specific issue. Oracle strongly recommends applying security patches from Critical Patch Updates without delay to mitigate such vulnerabilities.

The vulnerability allows unauthorized access to critical or all data accessible by Oracle Work in Process, impacting confidentiality. There is no reported impact on integrity or availability. The attack requires network access via HTTP and low privileges but is considered difficult to exploit. No known active exploits have been reported.

Oracle's July 2026 Critical Patch Update advisory includes security patches addressing multiple vulnerabilities, including this one. Although no explicit patch or remediation level is stated for CVE-2026-60888, Oracle strongly recommends that customers apply the latest Critical Patch Updates promptly to mitigate this and other vulnerabilities. Organizations should verify patch availability and installation instructions via Oracle's official advisory at https://www.oracle.com/security-alerts/cpujul2026.html. No vendor advisory states that no action is required or that the vulnerability is already mitigated.