What is the CVSS score of CVE-2026-60444?

CVE-2026-60444 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60444?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 expose organizations to confidential data loss and unauthorized modification; any low-privileged user can read all stored data and alter…

How to fix or mitigate CVE-2026-60444?

Within 24 hours, identify and catalog all Oracle WebCenter Content deployments running versions 12.2.1.4.0 or 14.1.2.0.0; immediately restrict network access via firewall to authorized networks only. Within 7 days, disable HTTP and enforce HTTPS-only communication; review all audit logs for suspicious data access by low-privileged accounts and investigate any unauthorized retrieval of sensitive information. Within 30 days, contact Oracle for patch timelines, plan upgrades to patched versions, and implement network isolation for WebCenter Content infrastructure until patches are deployed.

Oracle WebCenter Content CVE-2026-60444

EUVD-2026-46840 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-j738-ggrf-mp63

Authentication Bypass Oracle Webcenter Content

8.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

8.5 HIGH

Network HTTP access with an existing low-privileged account (PR:L, AV:N, AC:L); full read exposure (C:H) with partial write (I:L), no availability impact, and cross-product scope change (S:C).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:51 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.5

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).

AnalysisAI

Sensitive data disclosure and partial data tampering in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged, network-based attacker over HTTP to gain complete read access to all data the product can reach and to modify some of that data. Oracle rates the flaw CVSS 3.1 8.5 with a scope change, meaning exploitation can significantly impact adjacent products beyond WebCenter Content itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so treat this as a high-severity but not confirmed-exploited issue.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform within Oracle Fusion Middleware; the affected 'Content Server' component is the core repository engine that stores, indexes, and serves documents and metadata, typically fronted by an HTTP/HTTPS servlet interface. The vulnerability lives in how the Content Server processes authenticated HTTP requests, and the vendor-supplied 'Authentication Bypass' tag combined with the scope-change (S:C) rating suggests a request handled at one trust boundary can reach data or services under a different security authority. Oracle did not assign a CWE (CWE: N/A) and did not publish component-level root-cause detail, so the precise weakness class (e.g., improper authorization or access-control bypass) is inferred from the description rather than confirmed. The CPE/version data confirms exactly two supported branches are affected: the 12.2.1.4.0 and 14.1.2.0.0 release lines.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected 12.2.1.4.0 and 14.1.2.0.0 branches; this is a vendor patch available per the CPU advisory, though the input does not enumerate an exact patched build number, so obtain the precise patch/bundle from the CPU matrix for your version. Because exploitation requires a low-privileged account with HTTP access, until patching is complete you can reduce exposure by restricting network reachability of the Content Server interface to trusted segments (e.g., place it behind a VPN or WAF and block direct internet exposure), tightening account provisioning and disabling unused or guest-level WebCenter accounts, and reviewing authorization roles so fewer users hold low-privilege access to the Content Server - each of these narrows the attacker pool but does not close the underlying flaw and may affect legitimate remote or federated users. There is no vendor-published workaround in the provided data, so patching via the July 2026 CPU is the definitive fix.