This vulnerability affects Oracle Order Management versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of data. The vulnerability has a CVSS 3.1 base score of 6.4 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and impacts on confidentiality and integrity but not availability. The vulnerability may also impact additional Oracle products due to scope change. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a patch for this vulnerability. Patch status is therefore not yet confirmed and should be verified with Oracle's advisory.

Exploitation of this vulnerability allows an attacker with low privileges and network access to perform unauthorized read and write operations on Oracle Order Management data, potentially compromising confidentiality and integrity of some data. The vulnerability does not impact availability. Due to scope change, other Oracle products may also be affected indirectly. The CVSS score of 6.4 reflects a medium severity impact.

Oracle's July 2026 Critical Patch Update advisory includes numerous security patches across products. However, the advisory does not explicitly confirm a patch for CVE-2026-60864. Therefore, patch status is not yet confirmed — users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance. Oracle strongly recommends applying all relevant security patches promptly to mitigate known vulnerabilities. Until a patch is confirmed and applied, limit network access to Oracle Order Management interfaces to trusted users only.