What is the CVSS score of CVE-2026-60465?

CVE-2026-60465 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60465?

Organizations running Oracle WebCenter Content Imaging (Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0) face immediate risk of complete system compromise and data breach from a critical…

How to fix or mitigate CVE-2026-60465?

During the first 24 hours, identify and inventory all systems running Oracle WebCenter Content Fusion Middleware versions 12.2.1.4.0 or 14.1.2.0.0, assess network exposure of affected Imaging instances, and activate incident response readiness. Within 7 days, implement firewall rules restricting T3 and IIOP protocol access to trusted networks only, enforce role-based access controls to minimize low-privileged user access to Imaging, and deploy Web Application Firewall rules targeting WebLogic protocol anomalies. Within 30 days, monitor Oracle's security advisories for patch release, complete patch testing in non-production environments, and immediately deploy the vendor patch to all affected production systems upon availability.

Oracle WebCenter Content CVE-2026-60465

EUVD-2026-46859 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-5fw3-h2g9-qh2x

Authentication Bypass Oracle Webcenter Content

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable T3/IIOP with low complexity, low-privilege account required (PR:L), no user interaction, and full takeover yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:06 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise WebCenter Content: Imaging. Successful attacks of this vulnerability can result in takeover of WebCenter Content: Imaging. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Content: Imaging (Core component) in Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker sending crafted requests over the WebLogic T3 or IIOP protocols. Successful exploitation yields complete takeover of the Imaging service with high confidentiality, integrity, and availability impact (CVSS 8.8). This was disclosed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

WebCenter Content: Imaging is the document imaging and process-management module of Oracle WebCenter Content, deployed on Oracle WebLogic Server as part of Fusion Middleware. The affected attack surface is exposed through WebLogic's proprietary remote protocols T3 and IIOP (RMI over IIOP), which handle Java object serialization and remote EJB/JNDI invocation. Vulnerabilities reachable via T3/IIOP in the WebLogic stack have historically stemmed from unsafe Java deserialization or authorization gaps in remotely invokable objects; because Oracle publishes no CWE (listed as N/A) and no technical root-cause detail beyond 'Core', the precise weakness class cannot be confirmed from the available data, though the T3/IIOP vector and 'takeover' outcome are consistent with a deserialization or remote-invocation authorization flaw.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected 12.2.1.4.0 and 14.1.2.0.0 branches; Oracle does not publish a discrete fixed build number in the source data, so treat the CPU patch level as the remediation and consult the CPU matrix for the exact patch ID per platform (patch available per vendor advisory, exact fixed version not independently confirmed). As a compensating control until patching, restrict the WebLogic T3 and IIOP listen ports so they are not reachable from untrusted networks - use a WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) to allow T3/IIOP only from known management hosts, and block those ports at the network firewall; be aware this can break legitimate remote JMX/administration, clustered RMI, and integration clients that rely on T3/IIOP, so validate cluster and management connectivity after applying. Disabling IIOP entirely in the server configuration is advisable where no client depends on it. These controls reduce exposure but are not a substitute for the CPU patch.