This vulnerability affects Oracle Service Fulfillment Manager within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is easily exploitable by a low privileged attacker with network access via HTTP, enabling unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the product. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability does not impact availability. Oracle's July 2026 Critical Patch Update advisory references multiple patches across products but does not explicitly confirm patch availability for this specific vulnerability, so users must verify current patch status via the vendor advisory.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Service Fulfillment Manager, as well as unauthorized access to all data accessible by the product. This compromises the confidentiality and integrity of the data but does not affect availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required, increasing the risk of compromise if unpatched.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses numerous vulnerabilities across its product portfolio, including Oracle Service Fulfillment Manager. However, the advisory does not explicitly confirm the patch status for CVE-2026-60942. Users should promptly review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant security patches without delay. Until patches are applied, restrict network access to Oracle Service Fulfillment Manager where possible to reduce exposure.