What is the CVSS score of CVE-2026-60471?

CVE-2026-60471 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60471?

Oracle WebCenter Content: Imaging is vulnerable to unauthenticated network-based compromise (CVSS 8.3) enabling lateral movement to connected systems.

How to fix or mitigate CVE-2026-60471?

Within 24 hours, identify all systems running Oracle WebCenter Content: Imaging Core component and assess network exposure-particularly connectivity from untrusted network segments. Immediately implement strict network segmentation to restrict Imaging server access to authorized administrative networks only. Within 7 days, deploy enhanced logging and real-time monitoring for unauthorized access attempts to Imaging servers; review authentication configurations on all systems with network access to Imaging; and establish daily checks for Oracle security advisories. Within 30 days, establish direct vendor contact with Oracle for patch notifications; configure automated alerting for patch availability; and prepare a testing/deployment plan for immediate execution upon patch release, prioritizing production systems with highest network exposure.

Oracle WebCenter Content CVE-2026-60471

EUVD-2026-46865 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9wv9-qf7w-ggc7

Authentication Bypass Oracle Webcenter Content

8.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.3 HIGH

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Adjacent-segment access (AV:A) and difficult conditions (AC:H) per Oracle; no auth or interaction (PR:N/UI:N); scope change with full takeover justifies S:C and C/I/A:H.

3.1 AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:15 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.3

DescriptionCVE.org

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the WebCenter Content: Imaging executes to compromise WebCenter Content: Imaging. While the vulnerability is in WebCenter Content: Imaging, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of WebCenter Content: Imaging. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible for an unauthenticated attacker positioned on the same physical/adjacent network segment as the host, per Oracle's July 2026 Critical Patch Update (CVE-2026-60471). The flaw carries a CVSS 3.1 base score of 8.3 and, notably, a scope change (S:C) meaning successful exploitation can significantly impact additional products beyond Imaging itself, resulting in takeover. There is no public exploit identified at time of analysis and the issue is not on CISA KEV, but the confidentiality, integrity, and availability impact are all High.

Technical ContextAI

Oracle WebCenter Content: Imaging is the document-imaging and capture module of the Oracle WebCenter Content platform (part of Oracle Fusion Middleware), used for scanning, storing, and routing business documents and invoices within enterprise content management deployments. The affected component is 'Core', and Oracle tags this as Information Disclosure though the recorded impacts span C/I/A. The CVSS vector's Adjacent (AV:A) attack vector indicates the vulnerable service is reachable over the local/broadcast network segment rather than the full internet, and the scope change (S:C) implies the vulnerable component can pivot its authority into other Fusion Middleware components or the underlying platform. Oracle did not assign a CWE (CWE: N/A), so the precise root-cause class (e.g., authentication bypass, deserialization, or protocol flaw) is not disclosed in the available data.

RemediationAI

Apply the patches delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle addresses affected 12.2.1.4.0 and 14.1.2.0.0 deployments through the CPU, which is the primary and vendor-supported fix - the input does not specify a discrete fix build number, so consult the CPU patch matrix for the exact Imaging bundle patch for your version. Because the vulnerability requires adjacent-network access, the most effective compensating control until patching is network segmentation: place the WebCenter Content: Imaging host on an isolated management VLAN, restrict layer-2 reachability, and firewall the Imaging/Content service ports to only trusted application tiers, accepting the trade-off that legitimate imaging clients and capture agents must be explicitly allowed through. Given the scope change, also review and tighten the trust relationships and service-account privileges between Imaging and adjacent Fusion Middleware components to limit lateral impact. Patch status: Patch available per vendor advisory (Oracle July 2026 CPU); an exact patched version string was not provided in the input.