This vulnerability in Oracle BI Publisher's XML Services component permits an attacker with low privileges and network access via HTTP to compromise the system, potentially leading to unauthorized access to sensitive or all accessible data within Oracle BI Publisher. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. Affected versions explicitly include 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch for this specific vulnerability but strongly urges customers to apply available patches promptly. No known exploits have been reported in the wild.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle BI Publisher, compromising confidentiality. There is no reported impact on integrity or availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required.

Oracle's July 2026 Critical Patch Update advisory does not explicitly confirm a patch for CVE-2026-60673 but recommends that customers remain on actively supported versions and apply security patches without delay. Users should monitor Oracle's official security alerts and apply any relevant patches as soon as they become available. Since no official fix status is stated, patch status is not yet confirmed—check the vendor advisory for current remediation guidance.