This vulnerability in Oracle iSupport (component: Internal Operations) affects supported versions 12.2.3 to 12.2.15. It is easily exploitable by a low privileged attacker over the network via HTTP, resulting in unauthorized access to critical or all Oracle iSupport accessible data. The CVSS 3.1 base score is 7.7, with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. The vulnerability is classified under CWE-284 (Improper Access Control). The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly confirm a patch for this specific vulnerability but urges customers to apply available patches promptly and remain on supported versions.

Successful exploitation can lead to unauthorized access to critical or all data accessible via Oracle iSupport, compromising confidentiality. The vulnerability does not impact integrity or availability. Due to scope change, other Oracle products may also be affected indirectly. No known exploits in the wild have been reported at the time of publication.

Oracle's July 2026 Critical Patch Update advisory does not explicitly confirm a patch for CVE-2026-60824. Customers are strongly advised to remain on actively supported versions and apply all available security patches without delay as a general best practice. Patch status for this specific vulnerability is not yet confirmed—check Oracle's official security advisory for updates. No vendor-stated temporary mitigations or 'no action required' statements are present.