What is the CVSS score of CVE-2026-60633?

CVE-2026-60633 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60633?

Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is vulnerable to remote, unauthenticated compromise achieving complete system takeover with…

How to fix or mitigate CVE-2026-60633?

Immediately identify and inventory all systems running Oracle Fusion Middleware 12.2.1.4.0 or 14.1.2.0.0 with WebCenter Content enabled, then restrict network access to trusted networks and implement multi-factor authentication for all content server users within 24 hours. Within 7 days, deploy comprehensive audit logging to detect suspicious access patterns, conduct targeted user awareness training about phishing and social engineering tactics, and validate that firewall rules prevent direct internet exposure of content servers. Within 30 days, monitor Oracle's security advisories for patch availability and establish a tested deployment plan to apply the security update once released, while evaluating network segmentation to isolate WebCenter Content systems from other critical infrastructure.

Oracle WebCenter Content CVE-2026-60633

EUVD-2026-46991 HIGH

Improper Input Validation (CWE-20)

2026-07-21 secalert_us@oracle.com

GHSA-4qfp-3h74-25vh

Information Disclosure Oracle Webcenter Content

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote HTTP, no auth (PR:N) and low complexity, but requires victim interaction (UI:R); full takeover justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:17 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle WebCenter Content (Content Server component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is achievable by a remote, unauthenticated attacker over HTTP when a legitimate user is lured into interacting with attacker-influenced content. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R with high Confidentiality, Integrity and Availability impact (8.8), the flaw yields complete compromise of the content management system, though the required human interaction meaningfully narrows practical exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, so exploitation status remains theoretical based on Oracle's July 2026 CPU disclosure.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management (ECM) platform within Oracle Fusion Middleware, and the affected element is the Content Server - the core repository engine that stores, indexes, checks-in/out and renders managed documents over HTTP. The requirement for interaction 'from a person other than the attacker' combined with a network HTTP vector and unchanged scope is the classic signature of a client-side/browser-mediated flaw such as cross-site request forgery, stored/reflected script injection, or a crafted-link/document handling bug processed within an authenticated user's session. Oracle did not assign a CWE (CWE: N/A) and the tag set ('Information Disclosure', 'Oracle') understates the true impact, since the CVSS vector reports full C/I/A compromise rather than disclosure alone; the precise root-cause class cannot be confirmed from the available data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0; Oracle CPU advisories bundle the corrective patch per version, so follow the CPU matrix for the exact patch/bundle applicable to your release (an exact fix build number was not provided in the input and should be taken from the advisory). Patch available per vendor advisory. Because the attack requires a logged-in user to interact with malicious content, interim compensating controls include restricting Content Server access to trusted networks or VPN to shrink the attacker's ability to reach victims over HTTP, enforcing strict session handling and, where supported, anti-CSRF token validation and same-site cookie policies, and instructing content authors/administrators to avoid opening untrusted links or documents within an active WebCenter session - with the trade-off that network restrictions may impede legitimate external collaboration and stricter cookie/session policies can break embedded integrations. Deploying a WAF to filter cross-site request patterns against the Content Server endpoints is a reasonable stopgap, accepting the usual false-positive tuning cost, until the CPU is applied.