CVE-2026-60979 is a vulnerability in Oracle Scripting within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows a remote unauthenticated attacker with network access via HTTP to compromise the Oracle Scripting component. The vulnerability is rated with a CVSS 3.1 score of 8.1, reflecting high impact on confidentiality, integrity, and availability. The attack complexity is high, and no privileges or user interaction are required. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this vulnerability. The vendor strongly recommends applying available patches promptly. No exploits are currently known in the wild.

Successful exploitation of this vulnerability could lead to complete takeover of the Oracle Scripting component, impacting confidentiality, integrity, and availability of the affected system. This could allow an attacker to execute unauthorized actions within Oracle Scripting, potentially compromising sensitive data and disrupting operations.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. However, the advisory does not explicitly confirm a patch for CVE-2026-60979. Customers are strongly advised to review the July 2026 Critical Patch Update advisory and apply all relevant patches promptly to mitigate this and other vulnerabilities. Patch status is not yet confirmed specifically for this vulnerability—check the vendor advisory for current remediation guidance.