What is the CVSS score of CVE-2026-60502?

CVE-2026-60502 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60502?

A critical vulnerability in Oracle WebCenter Content Imaging allows network-accessible attackers with elevated system privileges to completely compromise the platform and access or manipulate…

How to fix or mitigate CVE-2026-60502?

Within 24 hours, conduct a complete inventory of Oracle Fusion Middleware deployments to identify all systems running versions 12.2.1.4.0 or 14.1.2.0.0 with the WebCenter Content Imaging component, and document which hosts and users require network access to these systems. Within 7 days, restrict access to T3 and IIOP protocols at the network and firewall level, limiting connections to only documented administrative hosts and accounts; enable detailed logging and alerting for all T3 and IIOP connection attempts; and audit all high-privileged accounts to remove unnecessary access. Within 30 days, monitor the Oracle Critical Patch Update release schedule for fixes to this vulnerability, establish a testing and deployment plan with vendor patched versions, and schedule production patching.

Oracle WebCenter Content CVE-2026-60502

EUVD-2026-46879 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-hp2h-89j7-q3gg

Authentication Bypass Oracle Webcenter Content

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable via T3/IIOP with low complexity, but description states a high-privileged attacker, so PR:H; full takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:21 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via T3, IIOP to compromise WebCenter Content: Imaging. Successful attacks of this vulnerability can result in takeover of WebCenter Content: Imaging. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with network access over the T3 or IIOP protocols can take over the Imaging application entirely (CVSS 3.1 7.2, high confidentiality, integrity and availability impact). Fixes are delivered in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

WebCenter Content: Imaging is a document imaging and capture module within Oracle Fusion Middleware, deployed on Oracle WebLogic Server. The named attack surface - T3 and IIOP - are WebLogic's proprietary remote invocation protocols used for RMI/EJB communication and clustering, which have historically been abused for deserialization and remote object manipulation attacks in the WebLogic ecosystem. Oracle attributes the flaw to the 'Core' component and CWE is not assigned (N/A), so the precise weakness class is unconfirmed; the tag 'Information Disclosure' plus the C:H/I:H/A:H rating and 'takeover' language point to full application-context compromise rather than mere data leakage.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which contains the fix for both affected releases (12.2.1.4.0 and 14.1.2.0.0); consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch bundle and component instructions, as Oracle CPUs ship as cumulative patches rather than a single tagged version (Patch available per vendor advisory; exact fixed build not enumerated in the provided data). Because exploitation traverses WebLogic T3 and IIOP, an effective compensating control until patching is to restrict or disable these protocols: use the WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to allow T3/IIOP only from trusted administrative hosts, or disable IIOP on the managed server if unused - trade-off is that legitimate RMI/EJB clients, clustering, and some management tooling that rely on T3/IIOP will break, so validate dependencies first. Additionally place the Imaging/WebLogic admin and listen ports behind network segmentation so they are not broadly reachable.