What is the CVSS score of CVE-2026-60466?

CVE-2026-60466 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60466?

Oracle WebCenter Content: Imaging in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 can be completely compromised by authenticated high-privilege attackers with network access, enabling…

How to fix or mitigate CVE-2026-60466?

Within 24 hours: Inventory all systems running Oracle WebCenter Content: Imaging versions 12.2.1.4.0 and 14.1.2.0.0, restrict HTTP network access to the Imaging service to essential business users only, and enable comprehensive audit logging for all Imaging service transactions. Within 7 days: Implement network segmentation to isolate Imaging services from untrusted networks, conduct a comprehensive review of privileged account logs and administrative activity for the past 30 days, and enforce multi-factor authentication for all high-privilege accounts with access to the Imaging component. Within 30 days: Evaluate and plan migration to patched versions of WebCenter Content when available, establish continuous monitoring for vendor security updates, and document all compensating controls in your risk management system.

Oracle WebCenter Content CVE-2026-60466

EUVD-2026-46860 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-wq86-pf4q-p85m

Authentication Bypass Oracle Webcenter Content

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP-reachable Core with full application takeover justifies AV:N/C:H/I:H/A:H, but the required administrative access mandates PR:H at low complexity.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:06 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise WebCenter Content: Imaging. Successful attacks of this vulnerability can result in takeover of WebCenter Content: Imaging. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with network access over HTTP can take over the Imaging service, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N) yields a 7.2 base score with high confidentiality, integrity, and availability impact, meaning the attacker gains complete control of the product. No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV, though the vendor tags it under Information Disclosure.

Technical ContextAI

WebCenter Content: Imaging is Oracle Fusion Middleware's document imaging and capture module (formerly Oracle I/PM), used for scanning, storing, and workflow-routing business documents such as invoices and forms, and it runs on Oracle WebLogic Server. The vulnerability resides in the 'Core' component and is reachable over HTTP, consistent with the product's web-based J2EE application architecture. No CWE was assigned by NVD or Oracle, so the precise weakness class (e.g., access control, injection, or deserialization) cannot be confirmed from the available data; Oracle's terse CPU advisory language ('takeover' with C/I/A high) indicates the authenticated attacker escapes the intended privilege boundary to fully control the Imaging application.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and vendor-recommended remediation for the affected 12.2.1.4.0 and 14.1.2.0.0 releases; Oracle does not publish standalone version numbers for these CPU patches, so identify the exact patch number for your Fusion Middleware/WebCenter Content deployment from the CPU patch matrix - Patch available per vendor advisory. Because exploitation requires high privileges (PR:H), compensating controls should focus on limiting who holds Imaging administrative rights: audit and reduce privileged WebCenter Content: Imaging accounts, enforce strong authentication and session management on those accounts, and restrict network reachability of the Imaging HTTP endpoints to trusted management networks or via a reverse proxy/WAF, accepting that tightening network access may disrupt legitimate remote administration and integrations. Monitor Imaging and WebLogic access logs for anomalous privileged activity as an interim detection measure until the CPU is applied.