This vulnerability affects Oracle Payments versions 12.2.3 to 12.2.15 in the File Transmission component. It permits a low privileged attacker with network access over HTTP to compromise the system, resulting in unauthorized access to critical or all Oracle Payments data and the ability to cause a partial denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. No known exploits in the wild have been reported. The vendor advisory from Oracle references a Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Payments and cause a partial denial of service affecting availability. The confidentiality impact is high, while integrity is not impacted, and availability impact is low. This could compromise sensitive payment data and disrupt Oracle Payments operations partially.

Oracle has published a Critical Patch Update advisory for July 2026 that includes numerous security patches. However, the vendor advisory does not explicitly confirm a patch for CVE-2026-60176. Therefore, patch status is not yet confirmed—check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches without delay and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Payments HTTP interfaces to trusted users only.