This vulnerability affects Oracle Customer Support versions 12.2.3 through 12.2.15 in the Update Service Request component. It permits a low privileged attacker with network access via HTTP to gain unauthorized capabilities that include creating, deleting, or modifying critical data or accessing all data accessible by Oracle Customer Support. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's July 2026 Critical Patch Update advisory references numerous patches across many products but does not explicitly confirm the patch availability or remediation status for this specific vulnerability. No known exploits in the wild have been reported as of the advisory date.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Customer Support, as well as unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of sensitive information but does not impact availability. The vulnerability is exploitable remotely over the network with low complexity and requires only low privileges, increasing the risk of compromise.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities across its product portfolio. Although the advisory does not explicitly confirm a patch for CVE-2026-60844, customers should promptly review and apply the relevant patches from the July 2026 Critical Patch Update to mitigate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is not yet explicitly confirmed for this vulnerability; therefore, customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance.