This vulnerability affects Oracle iStore versions 12.2.3 to 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the application, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle advises customers to remain on supported versions and apply security patches without delay to mitigate risks.

Successful exploitation can lead to unauthorized disclosure of critical data or complete access to all data accessible via Oracle iStore. There is no impact on data integrity or availability. The attack requires network access and is difficult to exploit, limiting the likelihood of widespread exploitation.

Oracle's July 2026 Critical Patch Update advisory recommends applying available security patches promptly. Although no explicit patch or remediation level is confirmed for CVE-2026-60816 in the advisory, customers should verify patch availability via Oracle's official security alerts and apply updates accordingly. Maintaining supported versions and timely patching is the primary mitigation. No vendor statement indicates that no action is required or that the issue is already mitigated.