CVE-2026-60923 is a vulnerability in Oracle Capacity versions 12.2.3 through 12.2.15 that allows a low privileged attacker with network access via HTTP to compromise the product. The vulnerability impacts confidentiality severely (CVSS 7.7) and can lead to unauthorized access to critical or all accessible data within Oracle Capacity. The vulnerability also has a scope change effect, potentially impacting additional Oracle products beyond Oracle Capacity. The vulnerability is publicly known and published, but no explicit remediation level or patch availability is confirmed in the vendor advisory. Oracle's July 2026 Critical Patch Update advisory references multiple patches across many products but does not specifically confirm a patch for this vulnerability. Customers are strongly advised to review the advisory and apply relevant patches promptly.

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible by Oracle Capacity. The vulnerability affects confidentiality with a high impact, while integrity and availability are not impacted. Due to the scope change, additional Oracle products may also be affected indirectly by attacks exploiting this vulnerability.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches without delay. Until a patch is confirmed and applied, restrict network access to Oracle Capacity interfaces to trusted users only and monitor for unusual access patterns.