This vulnerability affects Oracle Property Manager within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a high privileged attacker with network access via HTTP to compromise the system, leading to potential takeover of Oracle Property Manager. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The July 2026 Oracle Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability for this vulnerability. Customers are strongly advised to apply Oracle Critical Patch Updates promptly to mitigate risks.

Successful exploitation can lead to complete compromise of Oracle Property Manager, affecting confidentiality, integrity, and availability of the system. This could allow an attacker with high privileges and network access to take over the affected product, potentially impacting business operations relying on Oracle Property Manager.

Oracle has released a Critical Patch Update in July 2026 that addresses numerous vulnerabilities across Oracle products. Although the advisory does not explicitly confirm a patch for CVE-2026-60910, customers should promptly apply the July 2026 Critical Patch Update and any subsequent patches provided by Oracle. Staying on actively supported versions and timely patching are strongly recommended. Patch status is not yet confirmed specifically for this vulnerability—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance.