This vulnerability affects Oracle SDP Number Portability versions 12.2.3 to 12.2.15. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure where the product runs. Successful exploitation can lead to complete compromise of Oracle SDP Number Portability, with high impact on confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity and scope change that may impact other Oracle products. Oracle’s July 2026 Critical Patch Update advisory references multiple vulnerabilities but does not explicitly confirm a patch for this specific CVE. No known exploits in the wild have been reported.

The vulnerability allows an attacker with low privileges and logon access to fully compromise Oracle SDP Number Portability, resulting in complete takeover of the product. This includes high impact on confidentiality, integrity, and availability of the affected system. Additionally, the scope change indicates that other Oracle products may be significantly impacted by attacks exploiting this vulnerability.

Oracle has published a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities. However, the advisory does not explicitly confirm the availability of a patch for CVE-2026-60960. Customers should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply all relevant security patches promptly. Until a specific patch is confirmed, organizations should restrict access to the infrastructure hosting Oracle SDP Number Portability to trusted users only and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.