What is the CVSS score of CVE-2026-60634?

CVE-2026-60634 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Webcenter Content are affected by CVE-2026-60634?

Oracle WebCenter Content in Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is vulnerable to complete system compromise enabling full access to stored content and metadata via remote, unauthenticated…

How to fix or mitigate CVE-2026-60634?

Within 24 hours: Identify and document all systems running Oracle Fusion Middleware versions 12.2.1.4.0 or 14.1.2.0.0 with WebCenter Content deployed; notify relevant business owners and incident response teams. Within 7 days: Implement network segmentation restricting unauthenticated access to WebCenter Content application servers, enforce multi-factor authentication on WebCenter administrative and end-user portals, and conduct mandatory user briefing on social engineering tactics targeting suspicious content or links. Within 30 days: Establish monitoring for Oracle Security Advisories regarding patch release; develop upgrade strategy and change management plan for patched Fusion Middleware versions; identify business continuity priorities if component disabling is considered.

Webcenter Content CVE-2026-60634

EUVD-2026-46992 HIGH

Improper Input Validation (CWE-20)

2026-07-21 secalert_us@oracle.com

GHSA-2qhw-xvx8-xg64

Information Disclosure Oracle Webcenter Content

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:17 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a remote, unauthenticated attacker over HTTP, but only after luring a legitimate user into interacting with attacker-controlled input (UI:R). The CVSS 3.1 base score is 8.8 with High impact to confidentiality, integrity and availability, meaning a successful attack yields complete compromise of the product. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, so exploitation is theoretical rather than confirmed.