CVE-2026-60788 affects Oracle Sales Offline versions 12.2.3 through 12.2.15. It is an easily exploitable vulnerability that allows an attacker with low privileges and network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data within Oracle Sales Offline, and the ability to cause a partial denial of service. The vulnerability is classified under CWE-284 (Improper Access Control). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact. Oracle’s July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm a fix for this vulnerability. Customers are strongly advised to monitor Oracle advisories and apply patches promptly once available.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Sales Offline, unauthorized access to all accessible data, and partial denial of service conditions. The confidentiality and integrity impacts are high, while availability impact is low. This could compromise the integrity and confidentiality of sensitive business data managed by Oracle Sales Offline.

Oracle’s July 2026 Critical Patch Update advisory does not explicitly confirm a patch or remediation for CVE-2026-60788. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends customers remain on actively supported versions and apply security patches without delay once available. Until a patch is confirmed, restrict network access to Oracle Sales Offline to trusted users and monitor for unusual activity related to this component.