This vulnerability affects Oracle HRMS (France) versions 12.2.3 through 12.2.15 and allows an attacker with low privileges and network access via HTTP to gain unauthorized access to critical data. The attacker can create, delete, or modify data within the Oracle HRMS (France) system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory references a July 2026 Critical Patch Update containing numerous patches but does not explicitly confirm a patch for this specific vulnerability. Customers are urged to apply available patches promptly as Oracle emphasizes the importance of patching to prevent exploitation.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle HRMS (France), as well as unauthorized access to all accessible data in the affected system. This compromises confidentiality and integrity of sensitive HR data, potentially leading to significant operational and data security risks. Availability is not impacted according to the CVSS vector.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities across its product portfolio. Although the advisory does not explicitly confirm a patch for CVE-2026-60965, Oracle strongly recommends that customers remain on actively supported versions and apply all available security patches without delay to mitigate this vulnerability. Users should monitor Oracle's official security alerts and apply relevant patches as soon as they become available. Patch status is not yet confirmed for this specific vulnerability; check the vendor advisory for current remediation guidance.