What is the CVSS score of CVE-2026-60635?

CVE-2026-60635 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60635?

Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) is vulnerable to complete system takeover through unauthenticated remote attacks that exploit user interaction.

How to fix or mitigate CVE-2026-60635?

Within 24 hours: Identify and inventory all Oracle WebCenter Content deployments running versions 12.2.1.4.0 or 14.1.2.0.0, and document the systems' network accessibility and data criticality. Within 7 days: Implement network segmentation to restrict HTTP/HTTPS access to WebCenter Content servers from only trusted networks, reduce user access to essential personnel, and establish monitoring for suspicious authentication patterns or unauthorized content modifications. Within 30 days: Contact Oracle for patched version availability; prioritize immediate upgrade to a patched release, or evaluate migration to alternative content management platforms as a permanent resolution to eliminate this attack vector.

Oracle WebCenter Content CVE-2026-60635

EUVD-2026-46993 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-21 secalert_us@oracle.com

GHSA-36m3-jv8v-27f2

XSS Oracle Webcenter Content

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP vector with no attacker auth (PR:N) but mandatory victim interaction (UI:R); full takeover justifies C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:16 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle WebCenter Content (Content Server component) is possible when an unauthenticated remote attacker over HTTP lures a legitimate user into interacting with malicious content, per Oracle's July 2026 Critical Patch Update. Affected supported releases are 12.2.1.4.0 and 14.1.2.0.0, and the CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but rated high due to the complete-compromise outcome.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform within Oracle Fusion Middleware; the vulnerable Content Server component handles document ingestion, storage, indexing, and web-based retrieval over HTTP. The flaw resides in this web-facing server tier, which typically runs on WebLogic Server and is reachable through the browser-based content UI. No CWE was assigned by NVD or Oracle, so the precise root-cause class is not disclosed; however, the requirement for victim interaction (UI:R) combined with a network HTTP vector and the 'Information Disclosure' tag is consistent with a client-side vector such as reflected/stored cross-site content, request forgery, or a crafted link/document that executes in an authenticated victim's session context. The exact affected build strings map to Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0; no CPE strings were provided in the input.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html) to both 12.2.1.4.0 and 14.1.2.0.0 deployments; Oracle does not publish a standalone semantic fix version, so track the specific CPU patch numbers for your WebCenter Content release from that advisory rather than an invented version string. Because exploitation requires victim interaction over HTTP, effective compensating controls until patching include restricting network access to the Content Server web endpoints to trusted networks or a VPN, placing the UI behind a reverse proxy or WAF that filters crafted requests, and enforcing strong session and content-handling policies; user-awareness measures against clicking untrusted WebCenter links reduce the interaction trigger. Note the trade-off that network restrictions on the content UI can impede legitimate remote content authors and integrations, so scope allowlists to known consumer systems.