CVE-2026-60468 is a vulnerability in the Core component of Oracle Fusion Middleware's WebCenter Content: Imaging product. It affects versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical data or complete access to all accessible data, as well as unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this vulnerability. The vulnerability is categorized under CWE-284 (Improper Access Control).

Successful exploitation can lead to unauthorized access to critical and all accessible data within WebCenter Content: Imaging, as well as unauthorized modification (update, insert, delete) of some data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. No known exploits in the wild have been reported to date.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. However, the advisory does not explicitly confirm the availability of a patch or remediation for CVE-2026-60468. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant patches promptly. Until a patch is confirmed and applied, restrict network access to WebCenter Content: Imaging instances to trusted users only and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.