What is the CVSS score of CVE-2026-60522?

CVE-2026-60522 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60522?

Oracle WebCenter Content (Content Server) versions 12.2.1.4.0 and 14.1.2.0.0 contain a vulnerability allowing authenticated users to read all stored organizational content without proper…

How to fix or mitigate CVE-2026-60522?

Within 24 hours, inventory all systems running Oracle WebCenter Content versions 12.2.1.4.0 or 14.1.2.0.0 and restrict access where operationally feasible; document current user privileges and content repositories at risk. Within 7 days, obtain and test the July 2026 Critical Patch Update from Oracle in a non-production environment to validate compatibility with your deployment. Within 30 days, deploy the patch to all affected production systems, verify successful installation, and review the past month's access logs for indicators of unauthorized content access or exploitation.

Oracle WebCenter Content CVE-2026-60522

EUVD-2026-46884 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-w3ph-vj57-wpjq

Authentication Bypass Oracle Webcenter Content

7.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

vuln.today AI

7.6 HIGH

Authenticated low-priv attacker over HTTP (PR:L, AV:N) needs a victim interaction (UI:R); injection-style flaw yields high confidentiality, low integrity, no availability impact, with scope change reaching other products.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:12 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.6

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

AnalysisAI

Cross-context data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged authenticated attacker with HTTP network access to gain unauthorized read access to all WebCenter Content data and limited write access, provided a separate victim user is tricked into an interaction. Because the CVSS scope is changed (S:C), a successful attack can significantly impact resources beyond WebCenter Content itself, consistent with a stored/reflected injection-style flaw served through the content platform. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vulnerability was reported by Oracle and patched in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform within Oracle Fusion Middleware; the affected Content Server component is the core repository and web-facing document management engine that stores, indexes, and serves documents through an HTTP interface. The CVSS profile - network vector, low privileges, required user interaction, changed scope, and High confidentiality with Low integrity impact - is the classic signature of a client-side injection vulnerability (e.g., stored or reflected cross-site scripting) where attacker-supplied content is rendered in a victim's authenticated session. The supplier tag labels this as 'Authentication Bypass,' but the CVSS vector requires PR:L (the attacker must already authenticate at a low level), so the effective outcome is privilege/data-boundary crossing via the victim rather than pre-authentication bypass. No CWE was assigned in the source data, so the exact weakness class is inferred from the vector rather than confirmed.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected WebCenter Content releases 12.2.1.4.0 and 14.1.2.0.0 - Patch available per vendor advisory, though no discrete fixed build number was included in the source data, so obtain the exact patch identifier from the CPU matrix for your platform. Until patching is possible, reduce exposure by restricting network access to the Content Server HTTP interface to trusted internal networks or via VPN (trade-off: may break external partner/collaboration workflows that depend on web access), tightening account provisioning so fewer low-privileged users exist to serve as the PR:L foothold, and educating content-facing users about not opening or interacting with untrusted documents/links served through the portal to blunt the required user-interaction step. Because the flaw resembles a client-side injection, deploying or enforcing a strict Content-Security-Policy and output-encoding at any reverse proxy in front of WebCenter can partially mitigate script execution (trade-off: may interfere with legitimate embedded content or custom UI components).