This vulnerability affects Oracle HRMS (Ireland) versions 12.2.3 to 12.2.15 and involves unauthorized read access to a subset of accessible data by a high privileged attacker over the network via HTTP. The CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N, reflecting that exploitation requires high privileges and high attack complexity, with no user interaction needed. The vendor advisory from Oracle does not specify a dedicated patch for this vulnerability but references the July 2026 Critical Patch Update, which includes numerous security patches across Oracle products. Customers are urged to remain on supported versions and apply patches promptly to mitigate risks.

Successful exploitation results in unauthorized read access to some data within Oracle HRMS (Ireland). The impact is limited to confidentiality with no effect on integrity or availability. The vulnerability requires a high privileged attacker with network access via HTTP, making exploitation difficult. There are no known exploits in the wild reported at this time.

Oracle's advisory does not explicitly confirm a dedicated patch for CVE-2026-60950 but recommends applying the July 2026 Critical Patch Update, which addresses multiple vulnerabilities across Oracle products. Customers should ensure they are running supported versions and apply all relevant patches from the Critical Patch Update without delay. Since the vulnerability requires high privileges and network access, limiting access to Oracle HRMS interfaces and enforcing strict access controls may reduce risk. Patch status is not yet confirmed specifically for this vulnerability—check Oracle's official advisory for the latest remediation guidance.