This vulnerability in Oracle SDP Number Portability affects supported versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. The vendor advisory (Oracle Critical Patch Update July 2026) does not explicitly confirm a patch for this specific vulnerability but advises customers to apply the cumulative Critical Patch Update containing 1449 security patches across Oracle products. No cloud service remediation applies as this is not a cloud service. No known exploits have been reported in the wild.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data within Oracle SDP Number Portability, or unauthorized access to all accessible data. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability. The vulnerability can be exploited remotely over the network with low privileges and no user interaction required.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities across Oracle products. Although the advisory does not explicitly confirm a patch for CVE-2026-60959, customers are strongly advised to apply the latest Critical Patch Update promptly to mitigate this and other vulnerabilities. No alternative or temporary mitigations are specified. Since this is not a cloud service, remediation depends on customer patching. Monitor Oracle's security advisories for updates regarding this vulnerability.