CVE-2026-60310 affects Oracle Performance Management versions 12.2.3 through 12.2.15 and involves an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. The vulnerability is related to improper access control (CWE-284) in the Appraisals component of Oracle E-Business Suite. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, with limited confidentiality and integrity impacts and no availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch for this specific vulnerability, and remediation level is not stated. Oracle strongly recommends applying security patches without delay for all vulnerabilities included in their updates.

Successful exploitation of this vulnerability can lead to unauthorized reading of some data and unauthorized updating, inserting, or deleting of some data accessible through Oracle Performance Management. This compromises confidentiality and integrity of affected data but does not affect availability. The attacker requires only low privileges and network access via HTTP, making exploitation relatively straightforward if the system is exposed. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle's July 2026 Critical Patch Update advisory does not explicitly confirm a fix for this vulnerability. Oracle recommends customers remain on actively supported versions and apply security patches promptly when available. Until a patch is confirmed and applied, restrict network access to Oracle Performance Management interfaces to trusted users only and monitor for unusual activity related to data access or modification.