What is the CVSS score of CVE-2026-60435?

CVE-2026-60435 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Webcenter Content are affected by CVE-2026-60435?

Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) exposes organizations to total system compromise through unauthenticated network attack, with no remediation patch available from the…

How to fix or mitigate CVE-2026-60435?

Within 24 hours, inventory all systems running Oracle WebCenter Content versions 12.2.1.4.0 or 14.1.2.0.0, identify those with internet or untrusted network access, and escalate to Oracle for patch timeline confirmation. Within 7 days, implement strict network segmentation to restrict HTTP access to the WebCenter Content server to authorized internal networks only, and disable internet-facing access entirely. Within 30 days, develop and execute an upgrade path to patched versions when available, or migrate critical content to alternative platforms if upgrade timeline is unacceptable.

Webcenter Content CVE-2026-60435

EUVD-2026-46832 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-vgqw-3h5m-4gf8

Authentication Bypass Oracle Webcenter Content

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:48 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full remote takeover of Oracle WebCenter Content (Fusion Middleware Content Server) is possible when an unauthenticated attacker reaches the HTTP interface, per Oracle's July 2026 Critical Patch Update (CPU). The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0 and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector and Oracle 'takeover' language make it a top-priority patch.