This vulnerability affects Oracle Shipping Execution component of Oracle E-Business Suite, specifically versions 12.2.12 through 12.2.15. It is exploitable remotely over HTTP by an attacker with high privileges, enabling compromise of the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this vulnerability. Customers are advised to review the advisory and apply patches promptly.

Successful exploitation can lead to complete compromise of Oracle Shipping Execution, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially disrupting business operations and exposing sensitive data.

Oracle has released a Critical Patch Update in July 2026 that addresses numerous vulnerabilities across its product portfolio. Although the advisory does not explicitly confirm a patch for CVE-2026-60918, customers should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. It is strongly recommended to apply all relevant security patches without delay. Patch status for this specific vulnerability is not explicitly confirmed; therefore, check the vendor advisory for current remediation guidance.