What is the CVSS score of CVE-2026-60636?

CVE-2026-60636 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60636?

Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) is vulnerable to complete remote system compromise through a social engineering attack that tricks authorized users into clicking a…

How to fix or mitigate CVE-2026-60636?

Within 24 hours, identify and inventory all systems running Oracle WebCenter Content versions 12.2.1.4.0 or 14.1.2.0.0 to determine scope of exposure. Within 7 days, apply Oracle's July 2026 Critical Patch Update to all affected instances, beginning with production systems. Within 30 days, confirm patch deployment across all systems, validate version compliance in asset management systems, and review access logs for any signs of suspicious HTTP requests targeting these servers.

Oracle WebCenter Content CVE-2026-60636

EUVD-2026-46994 HIGH

Improper Input Validation (CWE-20)

2026-07-21 secalert_us@oracle.com

GHSA-r6gp-r4cp-835p

Information Disclosure Oracle Webcenter Content

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach with no auth (AV:N/PR:N) and low complexity, but a victim must interact (UI:R); takeover yields full C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:16 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover in Oracle WebCenter Content (Content Server component) 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to compromise confidentiality, integrity, and availability by luring a victim into interacting with a malicious HTTP request or link. The flaw carries a CVSS 3.1 base score of 8.8 and results in complete takeover, but exploitation requires human interaction from a legitimate user. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was fixed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform within Oracle Fusion Middleware; the vulnerable Content Server component provides the document check-in/check-out, indexing, and web-based repository services that back many internal document and records-management portals. The exploitable surface is the HTTP interface exposed by Content Server. Oracle categorizes this as network-reachable and easily exploitable, and the reporter tags it under Information Disclosure, though the CVSS impact set (C:H/I:H/A:H) and the 'takeover' language indicate the consequence extends well beyond disclosure to full compromise. No CWE was assigned in the source data, so the precise root-cause class (for example request forgery via a crafted link, deserialization, or injection reachable through a victim-triggered request) cannot be confirmed; the UI:R requirement strongly implies a browser-mediated or victim-triggered vector rather than a purely server-side automatable bug.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; consult that page for the exact patch set numbers covering WebCenter Content 12.2.1.4.0 and 14.1.2.0.0, as no discrete fixed build string was provided in the input. Until patching completes, reduce exposure of the Content Server HTTP interface by restricting access to the WebCenter Content web endpoints to trusted networks or placing them behind a VPN or authenticated reverse proxy, which limits reachability at the cost of remote or partner access to the repository. Because exploitation depends on user interaction, complement patching with user-awareness guidance against opening untrusted links that target internal WebCenter URLs, and where a web application firewall fronts the service, add filtering rules for anomalous requests to Content Server, accepting possible false positives on legitimate document workflows.