This vulnerability in Oracle Advanced Collections (component: Internal Operations) affects supported versions 12.2.3 to 12.2.15. It is easily exploitable by an attacker with low privileges and network access over HTTP, enabling compromise of the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability (score 8.8). The vendor advisory references a July 2026 Critical Patch Update containing numerous patches but does not explicitly confirm a patch for this vulnerability or provide remediation instructions. Patch status is therefore not yet confirmed and should be verified with Oracle's advisory.

Successful exploitation can lead to complete compromise of Oracle Advanced Collections, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access and control over sensitive business operations managed by Oracle Advanced Collections.

Oracle's July 2026 Critical Patch Update advisory does not explicitly confirm a patch for CVE-2026-60989. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant security patches promptly. Until a patch is confirmed and applied, restrict network access to Oracle Advanced Collections and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.