What is the CVSS score of CVE-2026-60448?

CVE-2026-60448 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60448?

CVE-2026-60448 affects Oracle WebCenter Content Server (versions 12.2.1.4.0 and 14.1.2.0.0), enabling unauthenticated remote attackers to read, modify, and delete sensitive data across the…

How to fix or mitigate CVE-2026-60448?

Within 24 hours, identify all systems running Oracle WebCenter Content versions 12.2.1.4.0 or 14.1.2.0.0 and assess their internet exposure and data sensitivity. Within 7 days, implement network segmentation to restrict access to affected Content Server instances, enable comprehensive audit logging for all data access and modifications, and establish daily monitoring of vendor security advisories. Within 30 days, evaluate upgrade paths to unaffected versions, deploy web application firewalls with rules to detect suspicious Content Server API activity, and maintain patch deployment procedures ready for immediate application upon vendor patch release.

Oracle WebCenter Content CVE-2026-60448

EUVD-2026-46844 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-ccjh-346x-fh7f

Authentication Bypass Oracle Webcenter Content

8.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.7 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Network HTTP reach with no auth or interaction (AV:N/PR:N/UI:N) but a hard-to-meet precondition (AC:H); confidentiality and integrity fully compromised across a scope change (S:C/C:H/I:H), no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:54 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.7

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Cross-scope data compromise in Oracle WebCenter Content (Content Server component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a remote unauthenticated attacker over HTTP read, create, delete, or modify all data accessible to the Content Server, with a scope change that can significantly impact other integrated Oracle Fusion Middleware products. Oracle rates it CVSS 3.1 8.7 (high complexity) with confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor tags suggest an authentication-bypass class issue.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform built on Oracle Fusion Middleware; the affected Content Server component is the core repository and web-facing service that stores, indexes, and serves documents and metadata, and it commonly federates with other Fusion Middleware services (WebLogic, portal, imaging), which explains the CVSS scope change (S:C). The vendor-supplied tag 'Authentication Bypass' indicates the root cause is likely an access-control/authentication weakness (CWE-287/CWE-863 class) allowing an unauthenticated request to reach privileged content operations - however, Oracle's advisory does not assign a CWE (CWE: N/A in the input), so the exact weakness class is inferred, not confirmed. The affected releases correspond to the 12.2.1.4.0 (12c) and 14.1.2.0.0 (14c) product lines.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update (CPU) that addresses CVE-2026-60448 for the affected WebCenter Content releases 12.2.1.4.0 and 14.1.2.0.0, following https://www.oracle.com/security-alerts/cpujul2026.html; Oracle does not publish a separate patched build number in the input beyond the CPU, so treat 'Patch available per vendor advisory' as the status and obtain the exact patch via My Oracle Support. Until patched, reduce exposure by restricting network reachability of the Content Server: place it behind a VPN or restrict HTTP/HTTPS access to trusted management networks and application tiers only, and block direct internet access to the Content Server endpoints - accepting that this breaks any external/partner web access to content. Add WAF or reverse-proxy rules to filter anomalous Content Server requests and tighten authentication enforcement on integrated Fusion Middleware components to limit blast radius from the scope change, understanding that WAF rules may not fully cover the (unknown, vendor-undisclosed) exploit path. Because the flaw is unauthenticated and scope-changing, prioritize any internet-exposed instances first.