CVE-2026-60554 affects Oracle WebCenter Sites, a component of Oracle Fusion Middleware. The vulnerability permits an unauthenticated attacker with network access over HTTP to compromise the product, potentially leading to unauthorized disclosure of critical data or complete access to all data accessible through Oracle WebCenter Sites. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact. Affected versions explicitly include 12.2.1.4.0 and 14.1.2.0.0. Oracle’s July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this vulnerability. No known exploits in the wild have been reported as of the advisory date.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive or critical data within Oracle WebCenter Sites. This compromises confidentiality but does not affect integrity or availability. The vulnerability is exploitable remotely without authentication, increasing the risk of data exposure in affected environments.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle WebCenter Sites instances to trusted users and networks where possible.