CVE-2026-60864 is a vulnerability affecting Oracle Order Management versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized update, insert, delete, and read access to some accessible data. The vulnerability has a CVSS 3.1 score of 6.4 with network attack vector, low attack complexity, low privileges required, no user interaction, and scope change. The vulnerability may also affect other Oracle products due to scope change. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation status for Oracle Order Management. Customers are advised to review the advisory and apply patches as recommended by Oracle.

The vulnerability allows unauthorized modification (update, insert, delete) and unauthorized reading of some Oracle Order Management data by a low privileged attacker with network access via HTTP. This compromises confidentiality and integrity of affected data. The scope change indicates that exploitation may impact additional Oracle products beyond Oracle Order Management. There is no indication of availability impact. No known exploits in the wild have been reported at this time.

Oracle has published a Critical Patch Update advisory in July 2026 that includes this vulnerability. However, the advisory does not explicitly confirm patch availability or remediation status for Oracle Order Management. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant patches promptly. Until patches are applied, restrict network access to Oracle Order Management HTTP interfaces to trusted users only. Monitor Oracle's advisories for updates on remediation status.