This vulnerability affects Oracle HTTP Server components within Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is characterized by an easily exploitable flaw that permits a low privileged attacker who has logon access to the underlying infrastructure to compromise the Oracle HTTP Server. Successful exploitation can lead to complete takeover of the server, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates local attack vector with low complexity, requiring low privileges and no user interaction. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide explicit patch details for it. No known exploits in the wild have been reported to date.

The vulnerability allows an attacker with low privileges and logon access to the infrastructure hosting Oracle HTTP Server to fully compromise the server. This results in high impact on confidentiality, integrity, and availability of the affected system, potentially enabling complete server takeover.

Oracle's July 2026 Critical Patch Update advisory recommends applying the provided security patches without delay. Although the advisory does not explicitly confirm a patch for CVE-2026-60454, it is part of the cumulative security updates. Organizations should review the Critical Patch Update documentation and apply all relevant patches promptly to mitigate this vulnerability. Patch status is not yet confirmed explicitly for this vulnerability; therefore, check the vendor advisory for current remediation guidance.