This vulnerability affects Oracle WebCenter Enterprise Capture component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It allows an attacker with low privileges and network access over HTTP to compromise the system, resulting in full takeover of the Oracle WebCenter Enterprise Capture product. The scope of impact may extend to other Oracle products. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability. The vendor advisory from Oracle (July 2026 Critical Patch Update) references this vulnerability but does not explicitly confirm patch availability or remediation status for this specific issue. Oracle advises customers to remain on supported versions and apply security patches without delay.

Successful exploitation results in complete compromise of Oracle WebCenter Enterprise Capture, including full confidentiality, integrity, and availability impacts. The vulnerability can lead to takeover of the affected product and may affect additional Oracle products due to scope change. This represents a critical security risk for organizations using the affected versions.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to address vulnerabilities. However, the advisory does not explicitly confirm a patch or remediation for CVE-2026-60447 at this time. Customers should monitor Oracle's official security alerts and apply patches as soon as they become available. Until a patch is confirmed, restrict network access to Oracle WebCenter Enterprise Capture instances to trusted users only and implement compensating controls as appropriate.