What is the CVSS score of CVE-2026-60472?

CVE-2026-60472 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60472?

Oracle WebCenter Content: Imaging deployments in Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to privilege escalation attacks that allow authenticated, low-privileged users to achieve…

How to fix or mitigate CVE-2026-60472?

Within 24 hours, inventory all Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 systems running WebCenter Content: Imaging and identify those accessible over HTTP; implement network segmentation or additional authentication controls to restrict attacker surface. Within 7 days, obtain Oracle's July 2026 Critical Patch Update, test it in a non-production environment to validate compatibility and functionality, and develop a staged deployment plan. Within 30 days, deploy the Critical Patch Update to all affected production systems, prioritizing those hosting the highest-value or most-sensitive content repositories, and verify successful remediation through patch validation.

Oracle WebCenter Content CVE-2026-60472

EUVD-2026-46866 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-gg56-3xgv-f3jx

Authentication Bypass Oracle Webcenter Content

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach with low complexity and no interaction, but a valid low-privilege account is required (PR:L); full takeover gives C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:15 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebCenter Content: Imaging. Successful attacks of this vulnerability can result in takeover of WebCenter Content: Imaging. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Privilege-based takeover of Oracle WebCenter Content: Imaging (Core component) in Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-authenticated attacker to fully compromise the product over HTTP, yielding high confidentiality, integrity, and availability impact. Fixed in Oracle's July 2026 Critical Patch Update, this flaw carries a CVSS 3.1 base score of 8.8 and is classed as easily exploitable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Content: Imaging is the document/image capture and workflow module of the WebCenter Content enterprise content management (ECM) platform, itself part of the Oracle Fusion Middleware stack running on Oracle WebLogic Server. The vulnerability resides in the 'Core' component and is reached over HTTP, indicating it is exposed through the product's web-facing servlet/application layer. Oracle does not publish a CWE for this CVE and the advisory gives no technical root-cause detail beyond 'easily exploitable' allowing 'takeover'; the Oracle-supplied tag 'Information Disclosure' hints at a disclosure element, though the full C/I/A high impacts point to a broader compromise of the authenticated session/application context rather than mere data leakage.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html) for the affected WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 deployments; Oracle does not publish a separate fixed build string beyond the CPU patch set, so map your version to the corresponding CPU patch in My Oracle Support. As compensating controls until the CPU is applied, restrict network reachability of the Imaging web endpoints to trusted management networks or behind a VPN/reverse proxy, tighten and audit low-privilege application accounts (since exploitation requires PR:L), and enable WebLogic/WAF request logging and monitoring on the Imaging URLs to detect abuse - note these controls reduce but do not eliminate risk for legitimate authenticated users and may disrupt integrations that rely on broad HTTP access to Imaging.