This vulnerability affects Oracle Project Intelligence, a component of Oracle E-Business Suite (Internal Operations), in versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system without user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory references a Critical Patch Update released in July 2026 covering many products but does not explicitly confirm patch availability for this specific vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to complete compromise of Oracle Project Intelligence, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially leading to unauthorized data access, modification, or service disruption.

Oracle has released a Critical Patch Update in July 2026 that addresses numerous security vulnerabilities across its products. Customers are strongly advised to apply the latest security patches promptly and remain on actively supported versions. The vendor advisory does not explicitly confirm a patch for CVE-2026-60901; therefore, users should consult the official Oracle Critical Patch Update documentation for detailed patch availability and installation instructions. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.