What is the CVSS score of CVE-2026-60462?

CVE-2026-60462 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60462?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to unauthenticated remote complete system compromise, enabling attackers to access all confidential data, modify content,…

How to fix or mitigate CVE-2026-60462?

Within 24 hours, inventory all systems running Oracle WebCenter Content versions 12.2.1.4.0 or 14.1.2.0.0 and assess their network exposure; immediately implement firewall rules restricting HTTP and HTTPS access to administrative networks only and segment these systems from general corporate networks. Within 7 days, deploy Web Application Firewall rules blocking suspicious requests to vulnerable endpoints, disable HTTP where HTTPS is available, implement host-based intrusion detection tuned for exploitation signatures, and establish continuous monitoring for unauthorized access attempts. Within 30 days, monitor Oracle's advisory schedule for the July 2026 Critical Patch Update, validate patch deployment in non-production environments matching your production configurations, and execute a phased production patching plan, prioritizing internet-facing systems first.

Oracle WebCenter Content CVE-2026-60462

EUVD-2026-46856 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-v9ch-257x-4v39

Authentication Bypass Oracle Webcenter Content

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated HTTP-reachable takeover justifies AV:N/PR:N/UI:N with full C/I/A; Oracle's 'difficult to exploit' classification supports AC:H and scope stays unchanged.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:05 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Content is possible in the Content Server component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a remote unauthenticated attacker reaching the server over HTTP can achieve complete takeover with full confidentiality, integrity, and availability impact. The flaw carries a CVSS 3.1 base score of 8.1, tempered by high attack complexity (AC:H) that makes reliable exploitation difficult. No public exploit identified at time of analysis, and it is not listed in CISA KEV, so risk is currently theoretical pending patch application from the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform used to store, manage, and deliver documents, images, and records; the affected code is the Content Server, its core repository and request-processing engine, which exposes HTTP-based services and idccommand/web interfaces. Because the attack vector is network HTTP with no authentication, the weakness lies in server-side request handling that is reachable pre-authentication. Oracle did not assign a CWE (listed N/A) and does not disclose root-cause details in its CPU advisories, but the 'Information Disclosure' tag combined with full C/I/A impact and 'takeover' language points to a server-side processing flaw (e.g., deserialization, XXE, SSRF, or injection) rather than a simple read-only disclosure. The reported CPE-equivalent affected products are Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected 12.2.1.4.0 and 14.1.2.0.0 branches - this is the primary and vendor-endorsed remediation; Patch available per vendor advisory, though no discrete standalone fix version is enumerated separately from the CPU. Oracle notes that unsupported/older releases are likely affected at higher risk and should be upgraded to a supported, patched level. Because the exploit path is unauthenticated over HTTP, effective compensating controls until the CPU is applied include restricting network reachability of the Content Server web interface to trusted management networks or VPN, placing it behind a reverse proxy or WAF that filters anomalous idccommand/service requests, and blocking direct internet exposure of the Content Server HTTP/HTTPS ports - with the trade-off that legitimate remote content-authoring and federated integrations may break and must be re-permitted explicitly.