This vulnerability affects Oracle Transportation Execution component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is exploitable remotely over the network via HTTP by an attacker with low privileges. Exploitation requires user interaction from a third party. The vulnerability can result in unauthorized modification (update, insert, delete) and unauthorized read access to some data within Oracle Transportation Execution. The vulnerability has a CVSS 3.1 score of 5.4, indicating medium severity with confidentiality and integrity impacts but no availability impact. The vulnerability also has scope change implications, potentially impacting other Oracle products. Oracle’s July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for this specific CVE. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized update, insert, or delete operations on some Oracle Transportation Execution accessible data, as well as unauthorized read access to a subset of that data. This compromises confidentiality and integrity of affected data. There is no reported impact on availability. The vulnerability requires user interaction from a person other than the attacker, limiting exploitability. The scope change indicates that other Oracle products might be affected indirectly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle’s July 2026 Critical Patch Update advisory includes this vulnerability among many others, but does not explicitly state patch availability or remediation instructions specific to CVE-2026-60957. Oracle strongly recommends applying Critical Patch Updates promptly to mitigate known vulnerabilities. Until an official patch or workaround is confirmed, organizations should monitor Oracle advisories and plan to apply updates as soon as they become available.