This vulnerability exists in the Internal Operations component of Oracle Payroll within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access over HTTP to exploit the flaw without user interaction, resulting in complete compromise of Oracle Payroll. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has acknowledged this vulnerability in its July 2026 Critical Patch Update advisory, which bundles security patches for multiple Oracle products. However, the vendor advisory does not explicitly confirm the availability of a specific patch for Oracle Payroll or provide remediation details for this CVE. Customers are strongly advised to review the advisory and apply updates promptly.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Payroll, impacting confidentiality, integrity, and availability of the system. This could lead to unauthorized access, data manipulation, and service disruption within Oracle Payroll.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. While the advisory does not explicitly confirm a dedicated patch for CVE-2026-60890, it strongly recommends customers remain on actively-supported versions and apply security patches without delay. Therefore, organizations should promptly review the July 2026 Critical Patch Update and apply all relevant patches to Oracle Payroll to mitigate this vulnerability. Patch status is not yet explicitly confirmed for this specific CVE; check the vendor advisory for the latest remediation guidance.