This vulnerability affects Oracle Project Contracts versions 12.2.3 through 12.2.15 and allows an attacker with low privileges and network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible through Oracle Project Contracts. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with network attack vector, low attack complexity, and no user interaction required. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch for this specific vulnerability but strongly recommends applying available patches promptly to mitigate risks.

The vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Project Contracts, as well as unauthorized access to all accessible data. This compromises the confidentiality and integrity of sensitive business data managed by Oracle Project Contracts. There is no impact on availability reported. No known exploits have been observed in the wild to date.

Oracle's July 2026 Critical Patch Update advisory recommends that customers remain on actively supported versions and apply security patches without delay. Although no explicit patch or remediation level is confirmed for CVE-2026-60848 in the advisory, applying the latest Critical Patch Update is strongly advised. Customers should monitor Oracle's official security alerts for updates regarding patch availability for this vulnerability.