This vulnerability in Oracle Supply Chain Trading Connector (component: Collaboration History) affects supported versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product by gaining unauthorized update, insert, or delete access to some accessible data, unauthorized read access to a subset of data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, with a base score of 6.3. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation level for this specific vulnerability. Oracle strongly recommends applying security patches without delay to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized modification (update, insert, delete) of some Oracle Supply Chain Trading Connector accessible data, unauthorized reading of a subset of that data, and partial denial of service conditions affecting availability. The impact affects confidentiality, integrity, and availability but is limited in scope as indicated by the CVSS score and vector.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly. However, the specific patch availability or remediation status for CVE-2026-60811 is not explicitly stated. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply relevant updates without delay. No vendor statement indicates that no action is required or that the issue is already mitigated.