This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by a low privileged attacker with network access via HTTP. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle WebCenter Content and can cause a partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability is associated with weaknesses classified under CWE-200 (Information Exposure), CWE-284 (Improper Access Control), and CWE-400 (Uncontrolled Resource Consumption). Oracle's July 2026 Critical Patch Update advisory references security patches for multiple products but does not explicitly confirm the patch status for this vulnerability. Users are advised to review the advisory and apply patches promptly.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to sensitive or all accessible data in Oracle WebCenter Content. Additionally, the attacker can cause a partial denial of service, impacting availability. The confidentiality impact is high, while availability impact is low. There is no impact on integrity. This could lead to exposure of critical data and disruption of service functionality.

Oracle has released a Critical Patch Update in July 2026 that includes security patches addressing multiple vulnerabilities across Oracle products, including Oracle WebCenter Content. However, the specific patch for CVE-2026-60647 is not explicitly confirmed in the advisory. It is strongly recommended that users running affected versions 12.2.1.4.0 and 14.1.2.0.0 consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions, and apply relevant patches without delay. Until patches are applied, users should consider restricting network access to Oracle WebCenter Content to trusted sources where feasible.