CVE-2026-60852 is a vulnerability in Oracle Lease and Finance Management versions 12.2.3 to 12.2.15 that allows a low privileged attacker with network access via HTTP to compromise the system. The vulnerability affects the Internal Operations component and can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory includes security patches for multiple products, and customers are urged to apply patches without delay. However, no specific patch or remediation level is explicitly confirmed for this vulnerability in the provided advisory content.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Oracle Lease and Finance Management. This compromises confidentiality and integrity of sensitive data managed by the product. Availability is not impacted. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities including this one. Customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Since no explicit patch availability or remediation level is stated for this vulnerability in the advisory content provided, users must verify patch status and installation instructions from the official Oracle advisory. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to mitigate exploitation risks.