What is the CVSS score of CVE-2026-60451?

CVE-2026-60451 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Webcenter Content are affected by CVE-2026-60451?

Oracle WebCenter Content's Imaging component (versions 12.2.1.4.0 and 14.1.2.0.0) contains a vulnerability allowing authenticated low-privileged users to read and modify stored imaging data without…

How to fix or mitigate CVE-2026-60451?

Within 24 hours, identify and inventory all systems running Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0; restrict or disable HTTP network access to the Imaging component if operationally feasible. Within 7 days, contact Oracle Support regarding patch availability for your specific configuration and establish a timeline for emergency patching once released. Within 30 days, apply the vendor-released patch upon availability and validate Imaging component functionality through security regression testing; if no patch is released within 30 days, enforce strict compensating controls including network segmentation and access monitoring.

Webcenter Content CVE-2026-60451

EUVD-2026-46847 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-qvrv-c93p-w276

Authentication Bypass Oracle Webcenter Content

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:01 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebCenter Content: Imaging. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all WebCenter Content: Imaging accessible data as well as unauthorized update, insert or delete access to some of WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Information disclosure and partial data tampering in the Imaging component (Core) of Oracle WebCenter Content, part of Oracle Fusion Middleware, affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with HTTP network access can compromise the Imaging service, gaining unauthorized read access to all Imaging-accessible data and limited unauthorized update, insert, or delete capability, addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis; the record carries an 'Authentication Bypass' tag despite the CVSS requiring low privileges (PR:L).