This vulnerability exists in the Core Receiving component of Oracle Inventory Management versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access over HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Inventory Management. The CVSS 3.1 base score is 8.1, indicating high severity with high confidentiality and integrity impact and no impact on availability. The vendor's July 2026 Critical Patch Update advisory lists many patches but does not explicitly state the remediation status for this vulnerability. Customers are advised to apply patches promptly as per Oracle's general guidance.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Inventory Management, as well as unauthorized access to all accessible data. This compromises the confidentiality and integrity of the system's data, potentially affecting business operations that rely on accurate inventory management information. There is no reported impact on system availability. No known exploits have been observed in the wild at this time.

Oracle's July 2026 Critical Patch Update advisory recommends applying available security patches promptly. However, the advisory does not explicitly confirm the availability of a patch for CVE-2026-60917. Therefore, patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Until a patch is confirmed and applied, restrict network access to Oracle Inventory Management HTTP interfaces to trusted users only and monitor for suspicious activity related to unauthorized data changes.