This vulnerability affects Oracle Customer Care within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is characterized by an easily exploitable flaw that allows an attacker with low privileges and network access via HTTP to compromise the system, potentially resulting in full takeover of Oracle Customer Care. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for this vulnerability. No known exploits in the wild have been reported as of the advisory date.

Successful exploitation can lead to complete compromise of Oracle Customer Care, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the product, potentially leading to unauthorized access to sensitive customer data and disruption of service.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses numerous vulnerabilities across its product portfolio. Although the advisory does not explicitly confirm a patch for CVE-2026-60920, Oracle strongly recommends that customers remain on actively supported versions and apply all available security patches without delay. Organizations using affected versions of Oracle Customer Care should monitor Oracle's official security alerts and apply Critical Patch Updates promptly once patches for this vulnerability are available. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.