This vulnerability affects Oracle Learning Management within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product, contingent on user interaction by a third party. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Learning Management. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impacts without availability impact. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm patch availability for this specific vulnerability.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Learning Management, as well as unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the affected system. The attack requires user interaction from a person other than the attacker, which is a prerequisite for successful exploitation. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

The vendor advisory references the July 2026 Critical Patch Update, which includes numerous security patches across Oracle products. However, it does not explicitly confirm a patch for CVE-2026-60945. Customers are strongly advised to review the July 2026 Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Applying the latest security patches promptly is recommended. Since this is not a cloud service, remediation depends on customer action. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.