This vulnerability affects Oracle iReceivables versions 12.2.3 through 12.2.15 and involves a weakness in the AR Web Utilities component. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is classified under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide a direct patch link or specific remediation instructions for it. Customers are urged to apply the cumulative patches from the advisory to address this and other vulnerabilities.

Successful exploitation of this vulnerability can result in complete takeover of the Oracle iReceivables product, impacting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via HTTP could exploit this flaw despite the high attack complexity. This could lead to unauthorized access and control over Oracle iReceivables, potentially compromising sensitive financial and business data managed by the application.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. While no specific patch link or remediation instructions for CVE-2026-60785 are explicitly provided, Oracle recommends that customers apply the latest Critical Patch Update patches promptly to mitigate this and other vulnerabilities. Organizations should verify patch availability and installation instructions from the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. No indication of 'no action required' or 'already mitigated' is present, so patching is the advised mitigation.