This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware. It is easily exploitable remotely without authentication but requires user interaction. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability involves weaknesses related to CWE-601 (URL Redirection), CWE-79 (Cross-site Scripting), and CWE-352 (Cross-Site Request Forgery). No official patch or remediation level is currently stated in the vendor advisory, but Oracle's July 2026 Critical Patch Update advisory references multiple security patches and strongly recommends applying available patches promptly. No known exploits in the wild have been reported at this time.

Successful exploitation can lead to full takeover of Oracle WebCenter Content, compromising confidentiality, integrity, and availability of the system. The attacker can operate remotely without authentication but requires another user to interact with the attack vector. This can result in unauthorized access and control over the affected product.

Oracle's July 2026 Critical Patch Update advisory recommends that customers apply security patches without delay to mitigate this and other vulnerabilities. Although no specific patch for CVE-2026-60664 is explicitly detailed in the advisory content provided, Oracle strongly urges staying on actively supported versions and promptly applying all relevant security updates. Patch status is not yet confirmed for this specific vulnerability — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance.