This vulnerability affects Oracle Mobile Application Server component MWA Terminal Server in versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to gain unauthorized access to critical data or full access to all accessible data, unauthorized ability to update, insert, or delete some data, and to cause a denial of service by hanging or crashing the server. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H with a base score of 6.7. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes many patches, but does not explicitly confirm the availability of a patch for this specific vulnerability in the provided content. Oracle emphasizes the importance of applying security patches without delay.

Successful exploitation can result in unauthorized access to critical data, partial unauthorized modification of data (update, insert, delete), and denial of service conditions causing the Oracle Mobile Application Server to hang or crash. The vulnerability requires high privileges and network access via HTTP. The confidentiality impact is high, integrity impact is low, and availability impact is high according to the CVSS vector.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to mitigate vulnerabilities. Although the advisory does not explicitly confirm a patch for CVE-2026-60846, it is part of the cumulative security updates. Organizations should verify patch availability and apply relevant updates from Oracle's official Critical Patch Update documentation. No vendor advisory states that no action is required or that the issue is already mitigated.