This vulnerability affects Oracle WebCenter Enterprise Capture (component: Client Bundle) in versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the product, resulting in potential takeover. The scope of impact may extend beyond this product to other Oracle products. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly state patch availability or remediation status for this specific vulnerability in the provided excerpt.

Successful exploitation can lead to complete compromise of Oracle WebCenter Enterprise Capture, including full confidentiality, integrity, and availability loss. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond WebCenter Enterprise Capture. This represents a critical risk to affected environments.

Oracle has published a Critical Patch Update advisory for July 2026 that addresses multiple vulnerabilities including this one. However, the provided advisory content does not explicitly confirm patch availability or remediation status for CVE-2026-60456. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation information. Until confirmed patched, organizations should prioritize applying Oracle's security updates promptly. No vendor statement indicates this vulnerability is already mitigated or requires no action.