This vulnerability (CVE-2026-60670) affects Oracle Applications Technology Stack versions 12.2.3 to 12.2.15, specifically the Client System Analyzer component. It allows an unauthenticated attacker with network access via HTTP to compromise the system, potentially leading to full takeover. The CVSS 3.1 base score is 8.1, indicating high severity with impacts on confidentiality, integrity, and availability. The attack complexity is high, requiring no privileges or user interaction. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among 1449 security patches but does not specify a direct patch version in the provided data. Users are advised to apply the Critical Patch Update promptly.

Successful exploitation can lead to complete compromise of the Oracle Applications Technology Stack, affecting confidentiality, integrity, and availability of the system. The vulnerability is exploitable remotely over the network without authentication, though it is difficult to exploit due to high attack complexity. There are no known exploits in the wild at this time.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability among others. Users should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Patch status is not explicitly confirmed for this specific vulnerability in the advisory text provided, so users must verify patch availability and installation instructions in the official Oracle Critical Patch Update documentation. No vendor advisory states that no action is required or that the vulnerability is already mitigated without patching.