What is the CVSS score of CVE-2026-60443?

CVE-2026-60443 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60443?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a HIGH-severity scope-changing vulnerability allowing low-privileged, network-based attackers to read, create, delete, and modify…

How to fix or mitigate CVE-2026-60443?

Within 24 hours, conduct an immediate asset inventory identifying all Oracle WebCenter Content systems running versions 12.2.1.4.0 or 14.1.2.0.0, classify the sensitivity of data they access, and assess network exposure. Over the next 7 days, implement network segmentation restricting WebCenter Content to pre-approved users and trusted network segments, enforce multi-factor authentication for all administrative access, enable comprehensive audit logging of all data access and modification events, and apply least-privilege access controls to all service accounts. Within 30 days, contact Oracle support to confirm patch availability and timeline, evaluate feasibility of upgrading to patched versions, and audit WebCenter Content logs for evidence of unauthorized data access or modification.

Oracle WebCenter Content CVE-2026-60443

EUVD-2026-46839 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-fq37-57gq-5qpm

Authentication Bypass Oracle Webcenter Content

8.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Authenticated low-privilege attacker over HTTP needs a second user's interaction (PR:L, UI:R); auth boundary crossed (S:C) yields high confidentiality and integrity loss with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:51 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.7

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

AnalysisAI

Scope-changing data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-based attacker read, create, delete, or modify all data accessible to the application. Exploitation is rated easy but requires tricking a separate user into an interaction (UI:R), and the flaw crosses a trust boundary to significantly impact additional products (scope change). No public exploit has been identified at time of analysis and it is not on CISA KEV; EPSS was not provided.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management (ECM) platform within Oracle Fusion Middleware; the affected sub-component is the Content Server, which handles document ingestion, storage, metadata, and retrieval over HTTP. The vulnerability sits in this HTTP-facing layer, and Oracle's scope-change (S:C) designation indicates the exploited authorization context differs from the impacted one - consistent with the vendor's 'Authentication Bypass' tag, meaning an attacker's action can be leveraged to reach data or products beyond their own authorization boundary. No CWE was assigned by NVD; the combination of a required interaction from another user plus authorization crossing (auth bypass/scope change) is characteristic of session-riding or confused-deputy weaknesses (e.g., CSRF-style or improper access control), but the exact root-cause class is not confirmed in the source data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Vendor-released patch: Oracle CPU July 2026) as documented at https://www.oracle.com/security-alerts/cpujul2026.html, which is the primary and authoritative remediation for both affected releases (12.2.1.4.0 and 14.1.2.0.0); Oracle does not publish standalone fixed build numbers outside the CPU, so track the CPU patch identifiers for your specific version. Because Oracle explicitly warns against running unsupported/unpatched configurations, prioritize the CPU over interim measures. Until patching completes, reduce exposure by restricting network access to the Content Server HTTP endpoints to trusted internal networks or via VPN/reverse-proxy allowlisting (trade-off: may block legitimate remote or partner access), and - given the required cross-user interaction and scope-change/auth-bypass nature - enforce anti-CSRF protections, tighten session handling, and warn privileged users against following untrusted links into the WebCenter Content UI (trade-off: user-behavior controls are imperfect and do not fully close the flaw). No independent alternative patch source exists beyond the Oracle CPU.