This vulnerability in Oracle U.S. Federal Financials (versions 12.2.3 to 12.2.15) allows a low privileged attacker with network access via HTTP to compromise the product by unauthorized creation, deletion, or modification of critical data or complete access to all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact without availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle’s July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation status for this specific issue.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible by Oracle U.S. Federal Financials. This compromises confidentiality and integrity of sensitive financial data managed by the product. There is no reported impact on system availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required, increasing the risk of compromise.

Oracle has released a Critical Patch Update in July 2026 that addresses numerous vulnerabilities across its product portfolio, including Oracle U.S. Federal Financials. However, the advisory does not explicitly confirm a patch or fix for CVE-2026-60686. Customers should consult the Oracle Critical Patch Update July 2026 advisory and associated patch availability documents for Oracle U.S. Federal Financials to determine if a patch is available and apply it promptly. Until a patch is confirmed and applied, restrict network access to Oracle U.S. Federal Financials HTTP interfaces to trusted users only and monitor for unusual activity. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.