This vulnerability in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to gain unauthorized access to critical data via HTTP network access. The vulnerability has a CVSS 3.1 score of 8.6, indicating high severity with a confidentiality impact only. The vulnerability scope extends beyond WebCenter Sites, potentially impacting other Oracle products. The vendor advisory does not explicitly confirm patch availability for this specific CVE but strongly recommends applying Critical Patch Updates without delay. No known exploits in the wild have been reported as of the publication date.

Successful exploitation results in unauthorized access to critical or complete data within Oracle WebCenter Sites. The vulnerability affects confidentiality but does not impact integrity or availability. The scope of impact may extend to additional Oracle products beyond WebCenter Sites, increasing potential risk to organizations using related Oracle software.

The vendor advisory does not explicitly confirm a patch for CVE-2026-60550 but strongly recommends that customers remain on actively supported versions and apply Oracle Critical Patch Updates promptly. Since no specific patch link or remediation level is provided, users should monitor the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for updates and apply relevant patches as soon as they become available. No vendor statement indicates that no action is required or that the issue is already mitigated.