This vulnerability exists in the BI Platform Security component of Oracle Business Intelligence Enterprise Edition. It is easily exploitable remotely without authentication over HTTP, enabling attackers to compromise the system and access or modify sensitive data. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The affected versions explicitly stated are 8.2.0.0.0 and 26.01.0.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for it. Customers are advised to consult the advisory for patch information and apply updates promptly.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Business Intelligence Enterprise Edition and unauthorized modification (update, insert, delete) of some data. This compromises data confidentiality and integrity but does not affect system availability. The vulnerability requires only network access via HTTP and no authentication, increasing its risk.

Oracle's July 2026 Critical Patch Update advisory includes multiple security patches and strongly recommends applying them without delay. However, the advisory does not explicitly confirm a patch or fix specifically for CVE-2026-60674. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Until patches are applied, restrict network access to Oracle Business Intelligence Enterprise Edition HTTP interfaces where possible and monitor for suspicious activity related to unauthorized data access or modification.