This vulnerability affects Oracle WebCenter Content (part of Oracle Fusion Middleware) in versions 12.2.1.4.0 and 14.1.2.0.0. It permits an unauthenticated attacker with network access via HTTP to compromise the system, contingent on user interaction by a third party. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, but user interaction is needed. The impact is high across confidentiality, integrity, and availability, potentially leading to full takeover of Oracle WebCenter Content. The vulnerability is associated with multiple CWEs including CWE-601 (URL Redirection), CWE-79 (Cross-site Scripting), CWE-352 (Cross-Site Request Forgery), and CWE-20 (Input Validation). The vendor advisory from Oracle (July 2026 Critical Patch Update) lists this vulnerability among many addressed but does not explicitly confirm patch availability or remediation level for this specific CVE. No known exploits in the wild have been reported.

Successful exploitation can lead to complete compromise of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially leading to unauthorized data access, modification, or service disruption.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many addressed; however, explicit patch availability or remediation details for CVE-2026-60639 are not confirmed in the advisory content provided. Customers are strongly advised to apply the latest Oracle Critical Patch Updates promptly and remain on actively supported versions. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.