What is the CVSS score of CVE-2026-60525?

CVE-2026-60525 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60525?

A critical vulnerability in Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) enables unauthorized data manipulation affecting all application data and potentially extending to connected…

How to fix or mitigate CVE-2026-60525?

Within 24 hours: identify and assess all WebCenter Content instances running versions 12.2.1.4.0 or 14.1.2.0.0 to determine exposure scope. Within 7 days: plan and test application of the July 2026 Critical Patch Update in a staging environment, including validation of dependent system compatibility and functional regression testing. Within 30 days: deploy the July 2026 Critical Patch Update to all production instances, verify successful remediation through configuration review, and document the complete remediation timeline.

Oracle WebCenter Content CVE-2026-60525

EUVD-2026-46887 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-rqvr-xqwj-p8v7

Authentication Bypass Oracle Webcenter Content

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.2 HIGH

Network HTTP reach with a required low-privileged account gives AV:N/PR:L; difficult preconditions justify AC:H; scope change (S:C) plus full read/write to content but no availability loss gives C:H/I:H/A:N.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:10 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-based attacker read, create, delete, or modify all data accessible to the application. Because the flaw carries a scope change, successful exploitation may also significantly impact products beyond WebCenter Content itself. No public exploit identified at time of analysis, and the flaw is rated difficult to exploit (AC:H); Oracle addressed it in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform within Oracle Fusion Middleware; the affected Content Server component handles document storage, indexing, retrieval, and access control for managed content. The vulnerability sits in this server-side layer, reachable over HTTP, and the scope-change flag (S:C) indicates the exploited component can pivot to affect resources managed by a different security authority - consistent with the vendor note that additional products may be significantly impacted. Oracle assigned no CWE; the supplied tag 'Authentication Bypass' suggests the root cause involves circumventing or abusing access-control checks, but Oracle's terse advisory does not confirm a specific weakness class.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPUs are cumulative, so install the latest CPU bundle for your WebCenter Content release rather than an isolated patch. Oracle did not publish a discrete fixed build number in the input data, so confirm the exact patch set for 12.2.1.4.0 and 14.1.2.0.0 from the CPU advisory before scheduling. Until patched, reduce exposure by restricting network access to the Content Server HTTP interface to trusted internal networks and VPN only, tightening the privileges of low-level application accounts (the attacker needs PR:L), and increasing monitoring of content create/delete/modify operations; note that restricting the HTTP endpoint may disrupt legitimate integrations and remote clients that rely on Content Server APIs.