What is the CVSS score of CVE-2026-60470?

CVE-2026-60470 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60470?

Oracle WebCenter Content: Imaging versions 12.2.1.4.0 and 14.1.2.0.0 contain a high-severity vulnerability enabling unauthorized access and modification of all managed content through authenticated…

How to fix or mitigate CVE-2026-60470?

Within 24 hours, identify and document all systems running Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 and assess operational criticality of Imaging. Within 7 days, isolate affected instances using network segmentation to restrict access from untrusted sources, restrict low-privileged account privileges in Imaging, and implement additional authentication factors for Imaging operations. Within 30 days, monitor Oracle Security Advisories for patch availability and plan upgrades to patched versions when released; if no patch becomes available, evaluate alternative content management solutions.

Oracle WebCenter Content CVE-2026-60470

EUVD-2026-46864 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-qpw8-h68p-rjw7

Authentication Bypass Oracle Webcenter Content

8.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Network HTTP reach and low complexity, but a valid low-privilege account (PR:L) and separate victim interaction (UI:R) are required; high C/I and no availability impact, with authorization bypass causing a scope change.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:14 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.7

DescriptionCVE.org

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebCenter Content: Imaging. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in WebCenter Content: Imaging, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all WebCenter Content: Imaging accessible data as well as unauthorized access to critical data or complete access to all WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle WebCenter Content: Imaging (Core component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all Imaging-accessible data by tricking an authenticated user into interacting with a malicious request. Rated CVSS 3.1 8.7 (High) with a scope change that lets exploitation impact additional connected Oracle Fusion Middleware products beyond Imaging itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; authentication is required (PR:L) plus victim interaction (UI:R), which meaningfully limits mass exploitation.

Technical ContextAI

Oracle WebCenter Content: Imaging is the document-imaging and business-process capture module of the Oracle WebCenter Content suite within Oracle Fusion Middleware, used for scanning, storing, routing, and annotating enterprise documents and invoices. The flaw resides in the Core component and, per the Oracle-supplied tags, is characterized as an authentication/authorization bypass that grants access to data the attacker's low-privilege account should not reach. No CWE was assigned by the source, but the behavior (a low-privileged principal obtaining unauthorized read and write access to all Imaging-accessible data, combined with a CVSS scope change) is consistent with improper access control / authorization weakness classes (e.g., CWE-862 Missing Authorization or CWE-863 Incorrect Authorization). The scope change (S:C) indicates the vulnerable Imaging component can be leveraged to affect other integrated products under a different security authority, typical of tightly coupled Fusion Middleware deployments.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0 - Patch available per vendor advisory; Oracle publishes exact patch/bundle numbers within the CPU matrix, so administrators should map their exact Fusion Middleware version to the corresponding CPU patch (no standalone fixed version string was given in the input, so cite the CPU rather than inventing a version number). Because exploitation requires a low-privilege authenticated account plus victim interaction, effective compensating controls until patching include restricting network access to the Imaging web interface to trusted management segments or via VPN/reverse proxy allowlisting (trade-off: may break remote user or integration access), auditing and pruning low-privilege Imaging accounts and tightening role/ACL assignments on document and application security groups (trade-off: administrative overhead and possible workflow disruption), and enforcing user-awareness/anti-phishing controls to reduce the UI:R social-engineering vector. Given the scope change, also review and segment integrations between Imaging and other connected Fusion Middleware products to contain lateral impact.