This vulnerability affects Oracle Lease and Finance Management versions 12.2.3 to 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or all accessible data within the product. The CVSS 3.1 vector indicates network attack vector (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high confidentiality and integrity impacts (C:H/I:H), with no impact on availability (A:N). Oracle's Critical Patch Update advisory for July 2026 mentions a large number of patches but does not explicitly state the patch status for this vulnerability, leaving remediation status unclear.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle Lease and Finance Management. This compromises confidentiality and integrity of the data, potentially leading to significant business impact. There is no reported impact on system availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Patch Update advisory in July 2026 covering numerous vulnerabilities, including this one. However, the advisory does not explicitly confirm patch availability or remediation status for CVE-2026-60852. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant security patches promptly. Until official patches are confirmed and applied, organizations should restrict network access to Oracle Lease and Finance Management instances to trusted users only and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.