This vulnerability affects Oracle Advanced Pricing versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that the attack can be performed remotely over the network with low attack complexity and low privileges, without user interaction, and results in high impact on confidentiality, integrity, and availability. The vulnerability is identified by multiple CWE identifiers related to improper access control and authorization. Oracle has published this issue in its July 2026 Critical Patch Update advisory, which addresses many vulnerabilities across Oracle products. The advisory recommends applying security patches promptly but does not explicitly state the patch status for this vulnerability. No known exploits have been reported.

Successful exploitation can lead to complete compromise of Oracle Advanced Pricing, impacting confidentiality, integrity, and availability of the affected system. This could allow an attacker to take over the product, potentially leading to unauthorized access, data manipulation, or service disruption.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others and strongly recommends applying security patches without delay. However, the advisory does not explicitly confirm the availability of a specific patch for CVE-2026-60863. Organizations should monitor Oracle's official security advisories and apply relevant patches as soon as they become available. Until a patch is confirmed, no specific mitigation steps are provided by the vendor.