This vulnerability affects Oracle Service Fulfillment Manager within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access over HTTP to gain unauthorized access that can result in creation, deletion, or modification of critical data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory does not explicitly confirm a patch for this specific vulnerability but strongly urges customers to apply available Critical Patch Updates without delay. The vulnerability is categorized under CWE-284 (Improper Access Control).

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Service Fulfillment Manager, as well as unauthorized access to all accessible data. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required.

The vendor advisory does not explicitly confirm a specific patch or remediation level for CVE-2026-60942 but strongly recommends applying Oracle's Critical Patch Updates promptly to mitigate vulnerabilities. Customers should verify the availability of patches for Oracle Service Fulfillment Manager versions 12.2.3 through 12.2.15 in the July 2026 Critical Patch Update and apply them without delay. Patch status is not yet confirmed specifically for this vulnerability; check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance.