CVE-2026-60948 affects Oracle Learning Management within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. This vulnerability arises from insufficient access control (CWE-284) and allows a low privileged attacker with network access via HTTP to perform unauthorized actions such as creating, deleting, or modifying critical data. The vulnerability has a CVSS 3.1 score of 8.1, reflecting high confidentiality and integrity impacts without affecting availability. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch or remediation level for this vulnerability. Customers are strongly advised to review the advisory and apply relevant patches promptly. No public exploits have been reported to date.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Learning Management, as well as unauthorized access to all accessible data. This compromises the confidentiality and integrity of the system's data but does not impact availability. The vulnerability can be exploited remotely by an attacker with low privileges and network access via HTTP.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Learning Management interfaces where possible to reduce exposure.