What is the CVSS score of CVE-2026-60637?

CVE-2026-60637 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60637?

A vulnerability in Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) enables complete system takeover by remote attackers, granting unauthorized access to all enterprise content, user…

How to fix or mitigate CVE-2026-60637?

Within 24 hours: Identify and enumerate all WebCenter Content instances running versions 12.2.1.4.0 or 14.1.2.0.0; restrict network access to trusted internal IP ranges only via firewall rules; disable remote access protocols and HTTP endpoints. Within 7 days: Deploy Web Application Firewall (WAF) rules to block exploitation attempts against Content Server components; enable centralized logging and SIEM ingestion of all WebCenter access; conduct employee security briefing on social engineering tactics targeting WebCenter access. Within 30 days: Initiate vendor contact with Oracle to confirm patch availability and ETA; evaluate migration options to patched versions or alternative enterprise content management platforms; conduct forensic audit for signs of prior compromise; implement multi-factor authentication for all WebCenter user accounts.

Oracle WebCenter Content CVE-2026-60637

EUVD-2026-46995 HIGH

Improper Input Validation (CWE-20)

2026-07-21 secalert_us@oracle.com

GHSA-f6cc-jf2f-7cqr

Information Disclosure Oracle Webcenter Content

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Unauthenticated network HTTP reach (AV:N/PR:N/AC:L) but takeover requires a victim to interact (UI:R); full C/I/A loss with no scope change (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:16 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 can be achieved by a remote, unauthenticated attacker over HTTP, provided a legitimate user is lured into a triggering interaction. Rated CVSS 8.8 with high confidentiality, integrity, and availability impact, successful exploitation yields takeover of the WebCenter Content instance. There is no public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and network vector make this a priority patch item.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform for storing, managing, and delivering documents, records, and digital assets, built on the Oracle Fusion Middleware / WebLogic stack. The affected component is the Content Server, the core web-facing service that handles HTTP requests for content check-in, retrieval, and administration. The advisory does not assign a CWE (listed as N/A), and Oracle's Critical Patch Update wording provides no root-cause class; the requirement for interaction from a person other than the attacker (UI:R combined with an unauthenticated vector) is consistent with a client-side vector such as cross-site request forgery or a stored/reflected content-injection issue that executes in the context of an authenticated operator, though the exact mechanism is not disclosed.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory; a discrete fixed build string was not published in the input beyond the affected 12.2.1.4.0 and 14.1.2.0.0 baselines, so consult the CPU patch matrix for the exact patch number for your version). Because exploitation requires luring an authenticated user into an interaction, until patching is complete you can reduce exposure by restricting network access to the Content Server so it is not reachable from untrusted networks (for example, placing it behind a VPN or reverse proxy with strict allow-lists), which trades off convenience for external or partner users; enforcing anti-CSRF protections and same-site cookie handling at any fronting proxy; and instructing administrators and content operators to avoid following untrusted links while authenticated to WebCenter Content. These are compensating controls only and do not substitute for the CPU patch.