This vulnerability affects Oracle Payroll within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is a difficult to exploit flaw that allows a low privileged attacker with network access over HTTP to compromise the Oracle Payroll system. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability relates to weaknesses in internal operations and access control (CWE-306, CWE-269, CWE-284). Oracle’s July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this specific CVE. Customers are urged to remain on supported versions and apply security patches without delay.

Successful exploitation can result in full compromise (takeover) of Oracle Payroll, impacting confidentiality, integrity, and availability of the system. This could allow unauthorized access and control over payroll operations. The vulnerability requires network access via HTTP and low privileges but is difficult to exploit. No known exploits in the wild have been reported at this time.

Oracle strongly recommends applying the latest Critical Patch Updates promptly to address this and other vulnerabilities. Although no explicit patch for CVE-2026-60894 is confirmed in the advisory content provided, the July 2026 Critical Patch Update contains numerous security fixes and should be reviewed and applied as soon as possible. Customers should remain on actively supported versions and follow Oracle’s official patching guidance available at https://www.oracle.com/security-alerts/cpujul2026.html. Patch status is not yet confirmed specifically for this CVE; check the vendor advisory for current remediation guidance.