This vulnerability affects Oracle Advanced Pricing versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Advanced Pricing. The CVSS 3.1 base score is 8.1, indicating high severity with high confidentiality and integrity impacts. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state the availability of a patch for it. The vendor strongly recommends applying security patches promptly and staying on actively supported versions.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Advanced Pricing, as well as unauthorized access to all data accessible by this product. This compromises the confidentiality and integrity of sensitive pricing data, potentially affecting business operations relying on accurate pricing information. There is no impact on availability reported.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. While the advisory does not explicitly confirm patch availability for CVE-2026-60867, Oracle strongly recommends that customers apply the latest security patches without delay and remain on actively supported versions. Organizations should monitor Oracle's official patch documentation linked in the advisory for confirmation of patch availability and installation instructions. No vendor advisory states that no action is required or that the issue is already mitigated.