CVE-2026-60982 is a vulnerability in Oracle US Federal Human Resources component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle urges customers to apply patches promptly to mitigate such vulnerabilities.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle US Federal Human Resources, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of sensitive data, potentially affecting critical operations relying on this system. Availability is not impacted according to the CVSS vector.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay to address vulnerabilities including this one. Although no explicit patch or remediation level is stated for CVE-2026-60982, customers should review the July 2026 CPU documentation and apply relevant patches promptly. No vendor advisory statement indicates that no action is required or that the vulnerability is already mitigated. Therefore, timely patching is the recommended mitigation.