This vulnerability affects Oracle WebCenter Content (component: Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over HTTP by unauthenticated attackers but requires user interaction from someone other than the attacker. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, affecting confidentiality and integrity with a scope change that may impact other Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality and integrity impact, and no availability impact. No known exploits in the wild have been reported. The vendor advisory from Oracle (July 2026 Critical Patch Update) lists this vulnerability among many addressed but does not explicitly confirm patch availability or remediation level for this specific CVE. Oracle strongly recommends applying patches from the Critical Patch Update promptly.

Exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, compromising confidentiality and integrity. The vulnerability's scope change means it may affect additional Oracle products beyond WebCenter Content. There is no impact on availability. The CVSS score of 9.3 indicates a critical severity level.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. While the advisory does not explicitly confirm the patch status for CVE-2026-60631, Oracle strongly recommends that customers apply the Critical Patch Update without delay to remediate this and other vulnerabilities. No vendor advisory states that no action is required or that the issue is already mitigated. Therefore, organizations should promptly review the July 2026 Critical Patch Update documentation and apply relevant patches to affected Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0.