CVE-2026-60908 is a vulnerability in the Oracle Installed Base product of Oracle E-Business Suite affecting versions 12.2.3 through 12.2.15. It involves the Create Item Instance component and allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical data or full access to all Oracle Installed Base accessible data, as well as unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, with a base score of 7.1. Oracle's July 2026 Critical Patch Update advisory lists this vulnerability among many others but does not explicitly confirm patch availability or remediation level for this specific issue. Customers are urged to remain on supported versions and apply security patches without delay.

The vulnerability allows an attacker with low privileges and network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle Installed Base. It also permits unauthorized modification actions such as update, insert, or delete on some accessible data. This compromises confidentiality and integrity of the affected system's data but does not impact availability.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products. However, the advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply relevant patches promptly. Until a patch is confirmed and applied, no specific workaround or temporary fix is documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.