This vulnerability affects Oracle Contracts Integration versions 12.2.3 to 12.2.15 and is classified under CWE-284 (Improper Access Control). It allows an attacker with low privileges and network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within Oracle Contracts Integration. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly state a patch or fix for this vulnerability. Customers are urged to apply available patches promptly as part of Oracle's cumulative security updates.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Contracts Integration, as well as unauthorized access to all accessible data. This compromises data confidentiality and integrity but does not affect availability. The vulnerability can be exploited remotely over the network with low privileges and no user interaction required.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory content provided does not explicitly confirm the availability of a specific patch for CVE-2026-60857. Customers should review the July 2026 Critical Patch Update documentation on Oracle's official site and apply any relevant patches promptly. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to mitigate exploitation risks.