CVE-2026-60952 is a vulnerability in Oracle Transportation Execution (component: Internal Operations) within Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full system takeover. The vulnerability has a CVSS 3.1 base score of 8.8 with high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for this vulnerability. Oracle advises customers to remain on supported versions and apply patches without delay to prevent exploitation. No known active exploits have been reported.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Transportation Execution, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access and control over sensitive operations within Oracle Transportation Execution.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to address vulnerabilities, including this one. However, explicit patch availability for CVE-2026-60952 is not confirmed in the advisory. Organizations should monitor Oracle's official security alerts for updates and apply patches as soon as they become available. Until patches are applied, restrict network access to Oracle Transportation Execution instances to trusted users only and follow Oracle's security best practices for this product.