This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware Web Content Management. It is easily exploitable by an attacker with low privileges and network access over HTTP. Successful exploitation can result in complete compromise of Oracle WebCenter Content, impacting confidentiality, integrity, and availability. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0. The vendor advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability but references a Critical Patch Update (CPU) released in July 2026 containing numerous patches. Customers are urged to apply security patches promptly to mitigate risks.

The vulnerability allows an attacker with low privileges and network access to fully compromise Oracle WebCenter Content, potentially leading to complete takeover of the product. This includes full loss of confidentiality, integrity, and availability of the affected system. Due to scope change, exploitation may also significantly impact other Oracle products integrated with or dependent on Oracle WebCenter Content.

The vendor advisory references the Oracle Critical Patch Update for July 2026, which includes numerous security patches. However, it does not explicitly confirm a patch or remediation level for CVE-2026-60663. Customers should review the July 2026 CPU advisory and apply all relevant patches promptly. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to prevent exploitation. Patch status is not yet confirmed for this specific vulnerability—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.