What is the CVSS score of CVE-2026-60334?

CVE-2026-60334 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60334?

Organizations deploying Oracle WebCenter Content 12.2.1.4.0 or 14.1.2.0.0 face imminent risk of complete system compromise, potentially exposing sensitive business content to theft or modification…

How to fix or mitigate CVE-2026-60334?

Within 24 hours: Audit all systems running Oracle WebCenter Content 12.2.1.4.0 or 14.1.2.0.0 and immediately restrict network access through firewall rules limiting HTTP/HTTPS traffic to known legitimate sources. Within 7 days: Assess upgrade paths to patched versions and coordinate with business owners to prioritize systems for migration. Within 30 days: Either complete migration to an unaffected version or implement comprehensive compensating controls including network segmentation, multi-factor authentication, WAF rules, and continuous audit logging and monitoring for indicators of compromise.

Oracle WebCenter Content CVE-2026-60334

EUVD-2026-46749 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-rpff-9f78-934c

Authentication Bypass Oracle Webcenter Content

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP access with low complexity and a low-privileged account (PR:L), no user interaction, yielding full application takeover so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:46 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Content (Content Server component) allows a low-privileged, network-based attacker over HTTP to take over the application, impacting confidentiality, integrity, and availability. Affected releases are 12.2.1.4.0 and 14.1.2.0.0, and the flaw is rated CVSS 3.1 8.8 and characterized by Oracle as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform within the Oracle Fusion Middleware stack, used for document management, imaging, records management, and digital asset management; the vulnerable Content Server is its core Java EE application accessed over HTTP/HTTPS. The affected component handles document ingestion, indexing, and retrieval and typically runs on Oracle WebLogic Server. Oracle assigns no CWE for this entry, so the precise root-cause class (e.g., injection, deserialization, access-control bypass, or path traversal) is not disclosed; the 'Information Disclosure' tag plus full C/I/A impact and the 'takeover' language point to an authenticated flaw that escalates beyond its granted privilege to control the whole application.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update: Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html - no discrete fixed version string is published in the input beyond the CPU bundle, so apply the CPU patch corresponding to your 12.2.1.4.0 or 14.1.2.0.0 installation. Because this is an authenticated, network-facing flaw, compensating controls until patching completes include restricting network reachability of the Content Server to trusted management networks or VPN (trade-off: may break legitimate remote or federated access), placing the application behind a WAF/reverse proxy with request inspection and rate limiting on the Content Server HTTP endpoints, tightening and auditing low-privilege user accounts and disabling unused or default accounts to raise the PR:L bar, and enabling detailed access logging on Content Server to detect abuse. These controls reduce exposure but do not remediate the underlying flaw, so treat them as temporary.