This vulnerability affects Oracle TeleSales versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of that data. The CVSS 3.1 base score is 5.4, reflecting low complexity attack vector (network), low attack complexity, low privileges required, no user interaction, and impacts limited to confidentiality and integrity. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this vulnerability. Oracle strongly recommends applying security patches without delay to mitigate such vulnerabilities.

The vulnerability allows unauthorized read and write access to certain Oracle TeleSales data, potentially leading to data confidentiality breaches and unauthorized data modification. There is no impact on system availability. The attack requires network access and low privileges but no user interaction. This could compromise the integrity and confidentiality of some Oracle TeleSales accessible data.

Oracle's July 2026 Critical Patch Update advisory recommends applying available security patches promptly. Although no explicit patch for CVE-2026-60794 is confirmed in the advisory content provided, Oracle strongly advises customers to remain on actively supported versions and apply Critical Patch Updates without delay to mitigate this and other vulnerabilities. Patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.