This vulnerability affects the Oracle Installed Base product of Oracle E-Business Suite, specifically the Create Item Instance component. It is exploitable remotely over HTTP by an attacker with low privileges, enabling unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Installed Base. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability is tracked as CWE-284 (Improper Access Control). The affected versions explicitly include 12.2.3 through 12.2.15. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability for this specific vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Installed Base, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the data but does not impact availability. The vulnerability allows a low privileged attacker with network access via HTTP to escalate their access to critical data, potentially leading to significant data breaches or data manipulation.

Oracle has released a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities across Oracle products. However, the advisory does not explicitly confirm the availability of a patch for CVE-2026-60904. Users should consult the Oracle Critical Patch Update July 2026 advisory and related patch availability documents to verify if a patch for this vulnerability is included and apply it promptly. Until confirmed patched, organizations should consider restricting network access to Oracle Installed Base interfaces and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.