This vulnerability in Oracle APEX (component: General) affects versions 24.1, 24.2, and 26.1. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle APEX by gaining unauthorized read access to a subset of accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. The vendor advisory from Oracle's July 2026 Critical Patch Update mentions this vulnerability but does not explicitly confirm patch availability or remediation level for it individually. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions.

Successful exploitation results in unauthorized read access to some Oracle APEX accessible data, impacting confidentiality. There is no impact on integrity or availability. The vulnerability can be exploited remotely without authentication or user interaction, making it relatively easy to exploit. However, the impact is limited to data disclosure of a subset of accessible data within Oracle APEX.

Oracle's July 2026 Critical Patch Update advisory includes many security patches and strongly recommends customers apply patches promptly and remain on supported versions. However, the advisory does not explicitly confirm a patch or remediation level specifically for CVE-2026-60156. Therefore, patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is confirmed, monitor Oracle's security alerts and apply updates as they become available.