This vulnerability affects Oracle WebCenter Content in versions 12.2.1.4.0 and 14.1.2.0.0. It permits a low privileged attacker with network access over HTTP to compromise the system, contingent on user interaction by a third party. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, user interaction needed, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is associated with multiple CWEs including CWE-601 (URL Redirection), CWE-640 (Weak Password Recovery), CWE-352 (Cross-Site Request Forgery), CWE-295 (Improper Certificate Validation), and CWE-20 (Input Validation). Oracle has published a Critical Patch Update advisory for July 2026 referencing this vulnerability but does not explicitly confirm patch availability or remediation status for this specific issue. No known exploits in the wild have been reported.

Successful exploitation can result in complete takeover of Oracle WebCenter Content, impacting confidentiality, integrity, and availability of the system. The attacker requires network access and low privileges but needs a user other than themselves to interact to trigger the exploit. This can lead to unauthorized access, data compromise, and disruption of service.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities including this one. However, the vendor advisory does not explicitly confirm the availability of a specific patch or remediation for CVE-2026-60648. Customers are strongly advised to review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant security patches promptly. Until a specific patch is confirmed, organizations should consider restricting network access to Oracle WebCenter Content and educate users to avoid interaction with suspicious content. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.