This vulnerability affects Oracle Property Manager within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It allows a high privileged attacker who already has logon access to the underlying infrastructure to compromise Oracle Property Manager and gain unauthorized read access to a subset of its accessible data. The CVSS 3.1 base score is 1.9, reflecting low confidentiality impact with no integrity or availability impact. The attack vector is local, requiring high attack complexity and privileges, and no user interaction is needed. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references the July 2026 Critical Patch Update, which includes numerous patches across Oracle products. Customers are strongly advised to apply Oracle's security patches promptly.

The impact is limited to unauthorized read access to some Oracle Property Manager data. There is no impact on data integrity or system availability. Exploitation requires high privileges and local access, making it difficult to exploit. No known exploits are reported in the wild.

Oracle recommends applying the July 2026 Critical Patch Update, which addresses multiple vulnerabilities across Oracle products. Although the vendor advisory does not explicitly confirm a patch for CVE-2026-60913, customers should remain on actively supported versions and apply all relevant security patches without delay. No alternative mitigations or workarounds are specified.