This vulnerability in Oracle US Federal Human Resources (component of Oracle E-Business Suite) affects supported versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's July 2026 Critical Patch Update advisory references many patches but does not explicitly confirm a patch for this specific vulnerability. Customers are strongly advised to apply Oracle patches promptly as per the advisory.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle US Federal Human Resources. It also allows unauthorized access to critical or all accessible data, severely impacting confidentiality and integrity. There is no impact on availability. This could compromise sensitive human resources data managed by the product.

Oracle's July 2026 Critical Patch Update advisory recommends customers remain on actively supported versions and apply security patches without delay. However, the advisory does not explicitly confirm a patch for CVE-2026-60982. Patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Until a patch is confirmed and applied, restrict network access to the affected Oracle US Federal Human Resources system to trusted users only and monitor for suspicious activity related to unauthorized data access or modification.