This vulnerability affects Oracle Project Portfolio Analysis, a component of Oracle E-Business Suite (Internal Operations), in supported versions 12.2.3 through 12.2.15. It is easily exploitable by a low privileged attacker with network access over HTTP, enabling unauthorized creation, deletion, or modification of critical or all accessible data within the product. The CVSS 3.1 base score is 8.1, indicating high severity with high confidentiality and integrity impacts and no impact on availability. The vendor advisory is a general Critical Patch Update for July 2026, listing many patched products but does not explicitly confirm patch availability or remediation details for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle Project Portfolio Analysis. This results in a complete compromise of data confidentiality and integrity within the affected product. There is no reported impact on system availability.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities across its product portfolio. However, the advisory does not explicitly confirm the availability of a patch or official fix for CVE-2026-60986. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant patches promptly. Until patch confirmation is obtained, monitor Oracle's advisories for updates. No vendor statement indicates that no action is required or that the vulnerability is already mitigated.