This vulnerability affects Oracle Enterprise Command Center Framework version 16 and permits a low privileged attacker with network access via HTTP to compromise the framework. Successful exploitation can lead to unauthorized access to critical or all accessible data and unauthorized modification (update, insert, delete) of some data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for this specific issue. Oracle strongly recommends applying security patches without delay to mitigate such vulnerabilities.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data or full access to all data accessible by the Oracle Enterprise Command Center Framework. Additionally, the attacker can perform unauthorized data modifications including updates, inserts, or deletions on some data. This compromises confidentiality and integrity of the affected system's data.

Oracle's advisory for the July 2026 Critical Patch Update recommends applying security patches promptly to address vulnerabilities including CVE-2026-60577. However, the vendor advisory does not explicitly confirm the availability of a specific patch or remediation level for this vulnerability. Organizations should monitor Oracle's official security alerts and apply relevant patches as soon as they become available. Until a patch is confirmed, restrict network access to the Oracle Enterprise Command Center Framework and apply principle of least privilege to limit potential exploitation.