This vulnerability affects Oracle WebCenter Sites, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges who has network access via HTTP. Successful exploitation can result in complete compromise of Oracle WebCenter Sites, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and scope change with high impact on confidentiality, integrity, and availability. Oracle's Critical Patch Update advisory for July 2026 mentions multiple patches but does not explicitly confirm a fix for this CVE or provide detailed remediation instructions.

Successful exploitation allows an attacker with low privileges and network access to fully compromise Oracle WebCenter Sites, resulting in complete loss of confidentiality, integrity, and availability of the affected system. Additionally, the attack may have a scope change effect, significantly impacting other Oracle products integrated or dependent on WebCenter Sites.

Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm patch availability or remediation for CVE-2026-60552. Customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply all relevant security updates promptly. Until an official fix is confirmed and applied, restrict network access to Oracle WebCenter Sites to trusted users only and monitor for unusual activity. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.