CVE-2026-60655 is a vulnerability in Oracle WebCenter Content, part of Oracle Fusion Middleware's Web Content Management component. It affects versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows an attacker with low privileges and network access via HTTP to compromise the system, potentially resulting in complete takeover of Oracle WebCenter Content. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for it individually. The advisory strongly recommends applying patches promptly to mitigate risks.

Successful exploitation can lead to complete compromise of Oracle WebCenter Content, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially leading to unauthorized access, data manipulation, and service disruption.

Oracle's July 2026 Critical Patch Update advisory includes security patches addressing this vulnerability among others. Although the advisory does not explicitly confirm patch availability for CVE-2026-60655 individually, Oracle recommends applying the Critical Patch Update without delay. Customers should verify patch applicability for their specific versions (12.2.1.4.0 and 14.1.2.0.0) and apply updates promptly. No vendor advisory states that no action is required or that the vulnerability is already mitigated. Patch status is not yet confirmed explicitly; therefore, check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance.