What is the CVSS score of CVE-2026-60335?

CVE-2026-60335 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60335?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability (CVSS 7.2) requiring high-level privileges that enables complete system compromise including data breach,…

How to fix or mitigate CVE-2026-60335?

Within 24 hours, inventory all systems running Oracle WebCenter Content versions 12.2.1.4.0 or 14.1.2.0.0 and classify their data sensitivity level. Within 7 days, enforce strict least-privilege access controls limiting administrative account usage to personnel requiring it, disable dormant high-privilege accounts, and request interim guidance from Oracle given no patch availability. Within 30 days, monitor Oracle's subsequent Critical Patch Update releases for security fixes, plan migration to patched versions upon availability, and implement compensating network controls such as IP whitelisting and enhanced audit logging.

Oracle WebCenter Content CVE-2026-60335

EUVD-2026-46750 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-gv7m-vqwx-m8x9

Authentication Bypass Oracle Webcenter Content

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP reach and low complexity, but a high-privilege account is required (PR:H); full takeover yields C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:47 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Content is possible via the Content Server component in Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0, where an attacker holding high privileges can send crafted HTTP requests to take over the product with confidentiality, integrity, and availability impact. Oracle rates the flaw CVSS 3.1 7.2 and describes it as easily exploitable once the required privilege level is held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the addressing of it in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform, part of the Oracle Fusion Middleware stack, used to store, manage, and deliver documents and digital assets. The vulnerable Content Server is the core repository and web-facing service that handles check-in/check-out, metadata, and HTTP-based content delivery. The advisory carries the tag 'Information Disclosure' but the CVSS impact profile (C:H/I:H/A:H) and the 'takeover' language indicate the weakness extends beyond disclosure to a full-service compromise. Oracle did not assign a CWE (CWE: N/A), so the precise root-cause class cannot be stated with certainty from the available data; the network/HTTP vector combined with a high-privilege requirement is consistent with an authenticated logic or injection flaw in a privileged Content Server function rather than a pre-auth entry point.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor's coordinated release addressing this issue for the affected 12.2.1.4.0 and 14.1.2.0.0 branches - patch available per vendor advisory, as the input does not enumerate an exact fixed build number, so confirm the specific patch/bundle for your version directly from the CPU matrix. Because exploitation requires a high-privilege account, compensating controls until patching completes should focus on tightening administrative access: restrict and audit Content Server administrator and privileged application accounts, enforce strong authentication and rotate credentials for those roles, and place the Content Server HTTP endpoints behind network segmentation or a reverse proxy that limits access to trusted management networks (trade-off: may disrupt legitimate remote administration and integrations that rely on broad HTTP reachability). Monitor Content Server logs for anomalous privileged HTTP actions. Do not rely on the 'Information Disclosure' tag to descope remediation, since the impact profile is full takeover.