This vulnerability affects Oracle HCM Configuration Workbench, a component of Oracle E-Business Suite (Rapid Implementation). It permits an attacker with low privileges and network access over HTTP to compromise the system, resulting in unauthorized access to sensitive data. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The affected versions explicitly include 12.2.3 through 12.2.15. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a patch for this vulnerability in the provided excerpt. No known exploits in the wild are reported.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle HCM Configuration Workbench. This compromises confidentiality but does not affect integrity or availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required, increasing the risk of data exposure.

Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for CVE-2026-60899 in the provided content. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and staying on actively supported versions. Until a patch is confirmed and applied, restrict network access to the Oracle HCM Configuration Workbench where possible to reduce exposure.