This vulnerability affects Oracle WebCenter Content: Imaging (component: Core) in versions 12.2.1.4.0 and 14.1.2.0.0. It allows a high privileged attacker with network access via T3 and IIOP protocols to compromise the system, resulting in potential full takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory is a general Critical Patch Update notice that includes this vulnerability among many others but does not explicitly state patch availability or mitigation steps for this specific CVE. No known exploits in the wild have been reported.

Successful exploitation can lead to complete compromise of Oracle WebCenter Content: Imaging, affecting confidentiality, integrity, and availability of the system. This could allow an attacker with high privileges and network access to take over the affected product.

Oracle has included this vulnerability in their July 2026 Critical Patch Update advisory. However, the advisory content provided does not explicitly confirm the availability of a patch or specific remediation steps for CVE-2026-60502. Customers are strongly advised to review the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant security patches promptly. Until a patch is confirmed and applied, limit network access to T3 and IIOP services to trusted users only and monitor for suspicious activity involving these protocols.