This vulnerability affects Oracle Universal Work Queue component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is easily exploitable by an attacker with low privileges who has network access via HTTP. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or all accessible data within Oracle Universal Work Queue. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The vendor advisory references a July 2026 Critical Patch Update containing numerous patches but does not explicitly confirm a patch for this specific vulnerability.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data within Oracle Universal Work Queue. This includes the ability to create, delete, or modify data without authorization, compromising data confidentiality and integrity. There is no reported impact on system availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple security vulnerabilities across its product portfolio. Customers are strongly advised to review the July 2026 Critical Patch Update advisory and apply the relevant patches promptly. Since the vendor advisory does not explicitly confirm the patch status for CVE-2026-60997, users should verify patch availability and installation instructions from Oracle's official advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Maintaining up-to-date patches is the primary mitigation. No vendor statement indicates that no action is required or that the vulnerability is already mitigated.