This vulnerability affects Oracle Treasury versions 12.2.3 to 12.2.15 and allows a low-privileged attacker with network access via HTTP to compromise the product. The attacker can gain unauthorized creation, deletion, or modification access to critical data or all data accessible by Oracle Treasury. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific vulnerability. Customers are strongly advised to apply Oracle Critical Patch Updates promptly.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Treasury, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of sensitive financial data managed by Oracle Treasury. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

The vendor advisory references the July 2026 Oracle Critical Patch Update, which contains numerous security patches. However, it does not explicitly confirm a patch or fix for CVE-2026-60963. Customers should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.