This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware Web Content Management. It is exploitable remotely over HTTP by an attacker with low privileges, requiring user interaction from a third party. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The affected versions explicitly stated are 12.2.1.4.0 and 14.1.2.0.0. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a fix for this CVE or provide detailed remediation instructions for these versions. Customers are advised to apply Oracle patches promptly as per the advisory.

Successful exploitation can lead to complete compromise of Oracle WebCenter Content, impacting confidentiality, integrity, and availability of the system. The attacker requires network access and low privileges but needs a user other than themselves to interact (social engineering or similar). This could allow takeover of the affected system, potentially leading to unauthorized data access, modification, or service disruption.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay and remaining on actively supported versions. However, the advisory does not explicitly confirm a patch or temporary fix for CVE-2026-60652 in the affected versions. Therefore, organizations should monitor Oracle's official security advisories and apply any relevant patches as soon as they become available. Until a patch is confirmed, consider restricting network access to Oracle WebCenter Content interfaces and educating users to be cautious of unexpected interactions that could trigger exploitation.