What is the CVSS score of CVE-2026-60523?

CVE-2026-60523 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60523?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a high-severity vulnerability (CVE-2026-60523, CVSS 8.7) enabling unauthorized reads and modifications across the content…

How to fix or mitigate CVE-2026-60523?

Within 24 hours: Identify all WebCenter Content deployments running versions 12.2.1.4.0 or 14.1.2.0.0 and assess exposure risk; immediately restrict network access to HTTP-facing functionality to trusted internal networks only or disable it if operationally feasible. Within 7 days: Implement multi-factor authentication for all WebCenter Content users, deploy detailed logging and monitoring of all Content Server data access and modification events, and conduct targeted user awareness training on social engineering risks targeting WebCenter Content interactions. Within 30 days: Develop a timeline and plan to upgrade to patched Oracle WebCenter Content versions when released by the vendor; actively coordinate with your Oracle account team for patch availability and release dates; conduct a comprehensive audit of all content server access logs from the last 90 days to detect any unauthorized reads or modifications that may have occurred.

Oracle WebCenter Content CVE-2026-60523

EUVD-2026-46885 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9f3f-3wq3-633f

Authentication Bypass Oracle Webcenter Content

8.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Network HTTP vector with low complexity; requires a low-privileged account (PR:L) and second-user interaction (UI:R); scope change to other Oracle products drives high C/I with no availability loss.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:11 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.7

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

AnalysisAI

Cross-context data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets a low-privileged, authenticated attacker abuse HTTP-facing functionality to read and modify all Content-Server-accessible data, with a scope change that can significantly impact adjacent Oracle products. Exploitation requires tricking a legitimate user into interacting with attacker-controlled content, and Oracle rates it CVSS 3.1 8.7 (confidentiality and integrity high, no availability impact). Disclosed in Oracle's July 2026 Critical Patch Update with no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Content (formerly Universal Content Management / Stellent) is an enterprise content and document management platform; the affected element is the Content Server, the core repository and web-request-handling engine deployed on Oracle Fusion Middleware WebLogic. The reporter tag 'Authentication Bypass' combined with UI:R and scope change (S:C) is consistent with a client-side or request-forgery style flaw where an authenticated user's session or trust boundary is leveraged to perform actions across a security boundary. Oracle assigned no CWE, so the precise weakness class is not formally categorized; the CVSS profile (C:H/I:H/A:N, no availability loss) points to an information-disclosure-plus-tampering flaw rather than memory corruption or denial of service.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected 12.2.1.4.0 and 14.1.2.0.0 branches; the input does not specify an exact patched build number, so treat the CPU July 2026 bundle as the patch source and confirm the precise interim/PSU patch ID for your version against My Oracle Support. Patch available per vendor advisory - no standalone fixed version string was provided in the source data, so verify the exact patch identifier before deployment. As compensating controls until patching, restrict network access to the Content Server HTTP endpoints to trusted internal networks or place them behind a WAF/reverse proxy that filters untrusted requests (trade-off: may break external partner/browser access to content), and because exploitation needs a low-privileged account plus user interaction, tighten account provisioning and remove unnecessary low-privilege WebCenter accounts and enforce user-awareness against interacting with untrusted links/content (trade-off: does not fully close the flaw). Do not rely on these controls as a substitute for the Oracle CPU patch.