This vulnerability (CVE-2026-60771) affects Oracle Complex Maintenance, Repair and Overhaul versions 12.2.3 through 12.2.15. It is an easily exploitable flaw that allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly confirm a patch for this specific vulnerability but strongly recommends applying available security patches promptly. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Complex Maintenance, Repair and Overhaul, or unauthorized access to all accessible data in the product. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported. The vulnerability allows a low privileged attacker with network access via HTTP to perform these actions, increasing the risk of data compromise or manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to mitigate vulnerabilities. Since no explicit patch or remediation level is stated for this vulnerability, customers should monitor Oracle's official security alerts and apply any relevant patches as soon as they become available. Until patched, restrict network access to the affected Oracle Complex Maintenance, Repair and Overhaul service to trusted users only.