This vulnerability affects Oracle iSupport versions 12.2.3 through 12.2.15 and involves improper access control (CWE-284) that could allow an unauthenticated remote attacker to gain unauthorized creation, deletion, modification, or access to critical data within Oracle iSupport. The CVSS 3.1 base score is 7.4, reflecting high confidentiality and integrity impacts with no availability impact. The attack vector is network-based over HTTP, with high attack complexity and no privileges or user interaction required. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch or remediation level for this specific vulnerability. Customers are urged to apply available patches promptly to mitigate risks from vulnerabilities disclosed in this update.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible via Oracle iSupport. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. No known exploits are currently active in the wild.

Oracle's July 2026 Critical Patch Update advisory includes multiple security patches across products. However, the advisory does not explicitly confirm a patch or remediation level for CVE-2026-60823. Customers should monitor the Oracle advisory for updates and apply any relevant patches promptly once available. Until an official patch is confirmed, no specific workaround or temporary fix is documented. Oracle recommends remaining on actively supported versions and applying security patches without delay.