What is the CVSS score of CVE-2026-60450?

CVE-2026-60450 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60450?

Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) can be completely compromised by unauthenticated remote attackers without requiring valid credentials, with no vendor patch currently…

How to fix or mitigate CVE-2026-60450?

Within 24 hours, conduct an inventory of all systems running WebCenter Content 12.2.1.4.0 or 14.1.2.0.0 and implement emergency network segmentation to restrict HTTPS access from untrusted networks to administrative sources only. Within 7 days, deploy WAF rules targeting exploitation patterns, configure enhanced logging and alerting for anomalous authentication attempts to these instances, and brief leadership on business continuity implications. Within 30 days, execute a migration plan to upgrade affected instances to patched versions once available from Oracle, or to alternative supported versions if enterprise requirements allow, and validate remediation through vulnerability rescanning.

Oracle WebCenter Content CVE-2026-60450

EUVD-2026-46846 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-4v9j-2p89-gg7m

Authentication Bypass Oracle Webcenter Content

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated HTTPS-reachable takeover gives PR:N/UI:N and C/I/A:H; Oracle's 'difficult to exploit' rating supports AC:H with unchanged scope.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:55 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Content (Content Server component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker with HTTPS network access can achieve complete takeover of the product. The CVSS 3.1 base score is 8.1 with high confidentiality, integrity, and availability impact, though the flaw is rated difficult to exploit (AC:H). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management (ECM) platform within Oracle Fusion Middleware, used for document, records, and digital asset management; the affected component is the Content Server, its core repository and services engine typically fronted over HTTP/HTTPS. The vulnerability is reachable over the network via HTTPS against the Content Server web tier without authentication. Oracle assigned no CWE (CWE: N/A) and the advisory tag indicates 'Information Disclosure,' but the CVSS vector shows full C/I/A impact consistent with a product takeover rather than pure data exposure, so the exact root-cause class (e.g., deserialization, authentication bypass, or injection) is not disclosed by Oracle's summary-level Critical Patch Update reporting.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to affected WebCenter Content installations running 12.2.1.4.0 and 14.1.2.0.0; the input identifies patch availability via this CPU advisory but does not list an exact patched build number, so treat this as patch available per vendor advisory and obtain the precise patch/PSU level from the Oracle CPU matrix and My Oracle Support. As compensating controls until patching, restrict network reachability of the Content Server HTTPS endpoint by placing it behind a VPN or IP-allowlisted reverse proxy and removing direct internet exposure (trade-off: may disrupt external content-sharing and federation use cases), and increase monitoring/WAF inspection of HTTPS requests to the Content Server (trade-off: WAF rules cannot be authored precisely without root-cause details Oracle has not published). Do not defer patching on the assumption of low risk, as the flaw permits unauthenticated full takeover.