This vulnerability affects Oracle Project Contracts versions 12.2.3 to 12.2.15 and involves a flaw that allows a low privileged attacker with network access over HTTP to read unauthorized data subsets within the product. The CVSS 3.1 base score is 3.1, reflecting a low severity with confidentiality impact only. The attack complexity is high, requiring network access and low privileges, with no user interaction needed. The vulnerability does not affect integrity or availability. Oracle has published this issue in their July 2026 Critical Patch Update advisory but has not explicitly confirmed patch availability or remediation status for this specific vulnerability within that advisory. Customers are advised to review the advisory and apply patches promptly if available.

Successful exploitation results in unauthorized read access to a subset of data accessible by Oracle Project Contracts. There is no impact on data integrity or system availability. The vulnerability is rated low severity due to its limited confidentiality impact and high attack complexity.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm a dedicated patch or remediation for CVE-2026-60939. Customers should consult the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant security updates promptly. Until a patch is applied, no specific workaround or mitigation is provided by Oracle. Maintaining up-to-date patches is strongly recommended.