CVE-2026-60989 affects Oracle Advanced Collections versions 12.2.3 through 12.2.15. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise the Oracle Advanced Collections component of Oracle E-Business Suite. Successful exploitation can lead to complete takeover of the product, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for this CVE. Customers are urged to apply the Critical Patch Update to address this and other vulnerabilities.

The vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Advanced Collections, resulting in complete takeover. This impacts confidentiality, integrity, and availability of the affected product. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. Although the advisory does not explicitly confirm a patch for CVE-2026-60989, customers should apply the July 2026 Critical Patch Update without delay to mitigate this vulnerability. Oracle strongly recommends staying on actively supported versions and promptly applying security patches. Patch status is not yet confirmed specifically for this CVE; check the vendor advisory for the latest remediation guidance.