This vulnerability affects Oracle WebCenter Sites, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable by unauthenticated attackers over HTTP but is considered difficult to exploit. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Sites, with a scope change potentially impacting additional Oracle products. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and a scope change with high confidentiality and integrity impacts but no availability impact. Oracle's Critical Patch Update advisory for July 2026 references this vulnerability but does not explicitly confirm patch availability or remediation level for this specific issue. Customers are urged to apply patches from the Critical Patch Update promptly to mitigate risks.

Successful exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Sites. It also allows unauthorized access to all accessible data in the product. The vulnerability affects confidentiality and integrity with high impact, but does not affect availability. Due to scope change, other Oracle products may also be significantly impacted by attacks exploiting this vulnerability.

Oracle's July 2026 Critical Patch Update advisory recommends that customers apply security patches without delay. However, the advisory does not explicitly confirm the availability of a patch or remediation level for CVE-2026-60553. Therefore, patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Customers should remain on actively supported versions and monitor Oracle's updates for patch releases addressing this vulnerability.