This vulnerability exists in the Oracle Installed Base product of the Oracle E-Business Suite, specifically in the Create Item Instance component. It is exploitable remotely over HTTP by an attacker with low privileges, enabling unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Installed Base. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with network attack vector, low attack complexity, and no user interaction required. The affected versions explicitly include 12.2.3 through 12.2.15. The vendor advisory from Oracle's July 2026 Critical Patch Update mentions a large set of patches but does not explicitly confirm patch availability or remediation status for this vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Installed Base, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the data but does not impact availability. The vulnerability can be exploited remotely over the network via HTTP by a low privileged attacker without user interaction.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities across Oracle products. However, the vendor advisory does not explicitly confirm patch availability or remediation status for CVE-2026-60904. Customers should review the July 2026 Critical Patch Update advisory and apply relevant patches promptly if available. Patch status is not yet confirmed specifically for this vulnerability — check the vendor advisory for current remediation guidance. Until patches are applied, restrict network access to Oracle Installed Base HTTP interfaces to trusted users only.