This vulnerability affects Oracle Property Manager within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is an easily exploitable flaw that permits a high privileged attacker with network access via HTTP to compromise the system, resulting in potential full takeover of Oracle Property Manager. The CVSS 3.1 base score is 7.2, indicating high severity, with impacts on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation status for it individually.

Successful exploitation allows a high privileged attacker with network access via HTTP to fully compromise Oracle Property Manager, impacting confidentiality, integrity, and availability of the system. This could lead to complete takeover of the affected product.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a specific patch for CVE-2026-60910. Customers are strongly recommended to remain on actively supported versions and apply all relevant security patches from the July 2026 Critical Patch Update without delay. Patch status is not yet confirmed for this specific vulnerability—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.