CVE-2026-60653 affects Oracle WebCenter Content (Oracle Fusion Middleware component Web Content Management) in versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows a low privileged attacker with network access via HTTP to perform unauthorized actions including creation, deletion, or modification of critical or all accessible data within Oracle WebCenter Content. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this CVE.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle WebCenter Content. Confidentiality and integrity of the data are highly impacted, potentially compromising sensitive information and data integrity. Availability is not impacted. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a patch is confirmed and applied, restrict network access to Oracle WebCenter Content instances and monitor for suspicious activity related to unauthorized data modification.