This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware Web Content Management. It allows an attacker with low privileges and network access over HTTP to compromise the system, potentially resulting in complete takeover. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2026-60654 and affects versions 12.2.1.4.0 and 14.1.2.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for these specific versions in the provided excerpt.

Successful exploitation can lead to full compromise of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially leading to unauthorized access, data manipulation, or service disruption.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the provided advisory content does not explicitly confirm the availability of a patch or official fix for the affected versions 12.2.1.4.0 and 14.1.2.0.0. Users should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant updates promptly. Until an official fix is confirmed and applied, organizations should consider restricting network access to Oracle WebCenter Content instances and monitor for suspicious activity related to this vulnerability.