This vulnerability affects Oracle Service Fulfillment Manager component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It enables a high privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data. The vulnerability impacts confidentiality and integrity with a CVSS 3.1 score of 8.7 and has a scope change affecting additional Oracle products. Oracle's July 2026 Critical Patch Update advisory references this vulnerability within a large set of patches but does not explicitly state the patch status or remediation level for this CVE. The vulnerability is publicly disclosed and considered easily exploitable, but no known exploits have been reported in the wild.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Service Fulfillment Manager, compromising confidentiality and integrity of data. The vulnerability may also impact additional Oracle products due to scope change. There is no reported impact on availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and scope change with high confidentiality and integrity impacts.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm patch availability or provide a specific remediation level for CVE-2026-60941. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Applying the relevant patches promptly is recommended to mitigate this vulnerability. Since this is not a cloud service, remediation depends on customer patching. Monitor Oracle advisories for updates on patch status.