CVE-2026-60923 is a vulnerability in the Oracle Capacity component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access over HTTP to compromise Oracle Capacity, resulting in unauthorized access to critical or all data accessible by Oracle Capacity. The vulnerability affects confidentiality (CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and may have scope change effects impacting other Oracle products. The vendor advisory from Oracle references this vulnerability within their July 2026 Critical Patch Update but does not explicitly state patch availability or remediation details for Oracle Capacity. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Capacity. The confidentiality impact is high, while integrity and availability are not affected. The vulnerability may also affect additional Oracle products due to scope change, potentially broadening the impact beyond Oracle Capacity itself.

Oracle has included this vulnerability in their July 2026 Critical Patch Update advisory. However, the advisory content provided does not explicitly confirm the availability of a patch or official remediation for Oracle Capacity. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is applied, organizations should limit network access to Oracle Capacity to trusted users and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.