This vulnerability in Oracle APEX Installation component affects versions 24.1, 24.2, and 26.1. It allows an attacker with low privileges and logon access to the infrastructure hosting Oracle APEX to compromise the application, resulting in unauthorized access to sensitive data. The CVSS vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. The vulnerability is tracked as CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level. No known exploits in the wild have been reported.

Successful exploitation can result in unauthorized access to critical or all data accessible through Oracle APEX. The confidentiality of data is impacted, but integrity and availability are not affected. The vulnerability requires local access with low privileges to the infrastructure where Oracle APEX executes.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many addressed issues. However, the advisory does not explicitly confirm patch availability or provide a specific remediation level for CVE-2026-60630. Users should monitor the Oracle advisory for updates and apply any relevant patches promptly once available. Until a patch is confirmed, restricting local access to the infrastructure and following Oracle's general security recommendations is advised. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.