This vulnerability in Oracle Applications Manager (component: Oracle Diagnostics Interfaces) affects supported versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, with limited confidentiality and integrity impacts and no availability impact. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle advises customers to remain on supported versions and apply patches without delay.

Successful exploitation can lead to unauthorized read and write access to certain Oracle Applications Manager data, potentially compromising confidentiality and integrity of that data. There is no impact on system availability. The vulnerability can be exploited remotely without authentication, increasing the risk exposure for affected systems accessible via HTTP.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to address vulnerabilities. Although no explicit patch or remediation level is stated for CVE-2026-60322, customers should verify patch availability in the referenced advisory and apply relevant updates. Maintaining supported versions and timely patching is strongly advised. No vendor advisory states that no action is required or that the issue is already mitigated.