This vulnerability affects Oracle WebCenter Content (component: Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. It permits an unauthenticated attacker with network access over HTTP to compromise the system, potentially leading to full takeover. Successful exploitation requires user interaction from a third party. The CVSS 3.1 base score is 7.5, indicating high severity with high impact on confidentiality, integrity, and availability. The vulnerability is documented under CVE-2026-60658 and involves multiple CWE categories including CWE-601 (URL Redirection), CWE-640 (Weak Password Recovery), CWE-352 (Cross-Site Request Forgery), and CWE-451 (XML External Entity Injection). The Oracle Critical Patch Update advisory from July 2026 references this vulnerability but does not explicitly confirm the availability of a patch or fix for it.

Successful exploitation can result in complete takeover of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. The attack requires network access via HTTP and user interaction from a person other than the attacker, making exploitation difficult. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions. Until a patch is confirmed and applied, organizations should be cautious of social engineering attempts that could trigger the required user interaction for exploitation.