What is the CVSS score of CVE-2026-60463?

CVE-2026-60463 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60463?

Oracle WebCenter Content: Imaging (Fusion Middleware Core) is vulnerable to unauthenticated remote takeover (CVE-2026-60463, CVSS 9.8) that grants attackers complete system access; no vendor patch is…

How to fix or mitigate CVE-2026-60463?

Within 24 hours: immediately inventory all Oracle WebCenter Content: Imaging deployments and document network exposure; isolate systems from untrusted networks or restrict access to T3 and IIOP protocols at the network perimeter. Within 7 days: implement network segmentation to limit lateral movement if compromise occurs; enable enhanced logging and monitoring on all affected instances; contact Oracle support for interim mitigation guidance and patch timeline. Within 30 days: monitor Oracle Critical Patch Updates and vendor advisories for a released patch; develop and test a patching or upgrade plan; assess whether affected systems can be decommissioned or replaced as a longer-term mitigation strategy.

Oracle WebCenter Content CVE-2026-60463

EUVD-2026-46857 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-4jgr-9qc8-cc83

Authentication Bypass Oracle Webcenter Content

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network exploitation over T3/IIOP with low complexity and no user interaction yields full product takeover, so PR:N/UI:N/AC:L and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:05 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise WebCenter Content: Imaging. Successful attacks of this vulnerability can result in takeover of WebCenter Content: Imaging. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebCenter Content: Imaging (Fusion Middleware Core component) allows an unauthenticated attacker with network access via the T3 or IIOP protocols to fully compromise the product, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not yet confirmed in the wild despite the maximal severity.

Technical ContextAI

The affected component is the Core of Oracle WebCenter Content: Imaging, an enterprise content-management and document-imaging module built on the Oracle WebLogic Server / Fusion Middleware stack. The stated attack surface - the T3 and IIOP remote protocols - is the WebLogic Server RMI transport used for clustering and remote EJB/JNDI invocation. Unauthenticated, network-reachable takeover via T3/IIOP is historically characteristic of Java object-deserialization flaws (CWE-502) in WebLogic-based products, where a crafted serialized object sent over these protocols is deserialized without validation, leading to code execution. Oracle publishes no CWE for this entry (CWE: N/A), so the deserialization root cause is inferred from the protocol vector rather than confirmed by Oracle.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected 12.2.1.4.0 and 14.1.2.0.0 branches; a patch is available per the vendor advisory, though a single discrete patched version string is not called out separately from the CPU bundle in the available data, so identify the exact patch set from the CPU matrix for your release. Because the vector is T3/IIOP, the primary compensating control until patching is to restrict these WebLogic protocols: configure WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to allow T3/T3S/IIOP only from trusted management hosts, and block external access to the WebLogic listen ports (default 7001, plus any IIOP/SSL ports) at the network firewall. Trade-off: filtering or disabling T3/IIOP can break WebLogic clustering, remote JMX/WLST administration, and remote EJB clients, so validate in a staging environment first. Placing the server behind a reverse proxy that only forwards HTTP(S) further reduces exposure without affecting web application traffic.