This vulnerability in Oracle E-Business Suite Secure Enterprise Search affects supported versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects network attack vector, low attack complexity, required low privileges, no user interaction, unchanged scope, and limited confidentiality and integrity impact with no availability impact. The vendor advisory references a Critical Patch Update released in July 2026 covering many products, including Oracle E-Business Suite components, but does not explicitly confirm the availability of a patch for this specific CVE.

Successful exploitation allows unauthorized read and write access to some data within Oracle E-Business Suite Secure Enterprise Search. This could lead to unauthorized modification (update, insert, delete) of accessible data and unauthorized disclosure of a subset of data. There is no reported impact on system availability. The vulnerability requires network access and low privileges but no user interaction.

The vendor advisory references the Oracle Critical Patch Update July 2026, which includes numerous security patches across Oracle products. However, the advisory does not explicitly confirm a patch for CVE-2026-61060. Therefore, patch status is not yet confirmed—check the Oracle Critical Patch Update July 2026 advisory and subsequent updates for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions to mitigate exploitation risks.