This vulnerability affects Oracle Order Entry versions 12.2.3 to 12.2.15 and permits a high privileged attacker who has logged onto the infrastructure hosting Oracle Order Entry to compromise the application. Exploitation can lead to unauthorized modification (update, insert, delete) of some data accessible by Oracle Order Entry and cause a partial denial of service. The CVSS vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle strongly urges customers to remain on supported versions and apply security patches without delay.

Successful exploitation allows unauthorized update, insert, or delete access to some Oracle Order Entry accessible data and can cause a partial denial of service affecting availability. Confidentiality is not impacted. The attack requires high privileges and local access to the infrastructure. The overall severity is low based on CVSS 3.1 score 3.4.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to address vulnerabilities. However, the advisory does not explicitly confirm a patch for CVE-2026-60847. Customers should verify patch availability in the referenced Oracle advisory and apply any relevant updates. Maintaining supported versions and applying Oracle Critical Patch Updates without delay is strongly advised. No vendor statement indicates that no action is required or that the issue is already mitigated.