This vulnerability in Oracle Scripting (component: Internal Operations) affects supported versions 12.2.3 to 12.2.15. It is difficult to exploit but allows an unauthenticated attacker with network access via HTTP to compromise Oracle Scripting, potentially resulting in full takeover. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector with high attack complexity and no privileges or user interaction required, impacting confidentiality, integrity, and availability. The vendor advisory is a general Critical Patch Update for July 2026 covering many products but does not explicitly confirm a patch for this specific vulnerability. No known exploits in the wild are reported.

Successful exploitation can lead to complete compromise of Oracle Scripting, impacting confidentiality, integrity, and availability of the affected component. This could allow an attacker to take over Oracle Scripting functions within Oracle E-Business Suite, potentially affecting business operations relying on this component.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities. However, the advisory does not explicitly confirm patch availability or remediation status for CVE-2026-60979 in Oracle Scripting. Customers are strongly advised to review the July 2026 Critical Patch Update advisory and apply all relevant patches promptly. Until explicit patch information is confirmed, monitor Oracle's official security alerts for updates. No vendor advisory states that no action is required or that the issue is already mitigated.