CVE-2026-60983 is a vulnerability in Oracle WebCenter Content (component: Content Server) affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low-privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privilege required, no user interaction, scope change, and high confidentiality impact. The vulnerability may also affect other Oracle products due to scope change. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 patches across multiple products. Oracle advises customers to remain on supported versions and apply patches without delay.

Successful exploitation of CVE-2026-60983 can lead to unauthorized access to critical data or complete access to all data accessible through Oracle WebCenter Content. The vulnerability affects confidentiality but does not impact integrity or availability. Due to scope change, other Oracle products may also be significantly impacted by attacks exploiting this vulnerability.

Oracle has released patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying all relevant patches without delay. No additional mitigation steps are specified beyond applying the official patches.