What is the CVSS score of CVE-2026-60638?

CVE-2026-60638 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60638?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain CVE-2026-60638, a critical vulnerability enabling remote, unauthenticated attackers to completely compromise systems and access…

How to fix or mitigate CVE-2026-60638?

Within 24 hours, identify and inventory all systems running Oracle WebCenter Content versions 12.2.1.4.0 or 14.1.2.0.0; assess internet exposure and user populations to evaluate real-world risk from the required social-engineering attack vector. Within 7 days, deploy Oracle's July 2026 Critical Patch Update to all affected systems. Within 30 days, validate complete patch deployment across the enterprise, review 90 days of content access logs for exploitation attempts, and strengthen email security and user awareness training to defend against the social-engineering vector.

Oracle WebCenter Content CVE-2026-60638

EUVD-2026-46996 HIGH

Improper Input Validation (CWE-20)

2026-07-21 secalert_us@oracle.com

GHSA-6597-4p8w-pv7q

Information Disclosure Oracle Webcenter Content

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable HTTP with no auth (AV:N/PR:N) and low complexity, but a victim must interact (UI:R); full takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:14 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle WebCenter Content (Content Server component of Oracle Fusion Middleware) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote, unauthenticated attacker sending crafted HTTP traffic can compromise confidentiality, integrity, and availability, but the attack requires human interaction from a user other than the attacker (UI:R). No public exploit has been identified at time of analysis, and the flaw is fixed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform used for document, records, and digital asset management; the affected component is the Content Server, its core web-facing service that handles check-in, retrieval, and rendering of managed content over HTTP. Because the vulnerability is reachable network-side without credentials and yields full takeover, the root cause most likely lies in the Content Server's HTTP request handling or content-processing logic. Oracle did not assign a CWE (CWE: N/A) and did not publish technical root-cause detail, consistent with its standard Critical Patch Update disclosure practice; the vendor tag 'Information Disclosure' is present but the CVSS impact (C:H/I:H/A:H, described as 'takeover') indicates impact well beyond disclosure alone.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Vendor-released patch per Oracle CPU July 2026, https://www.oracle.com/security-alerts/cpujul2026.html) for the affected 12.2.1.4.0 and 14.1.2.0.0 branches; Oracle distributes exact patch/bundle identifiers through My Oracle Support rather than a single named version string, so obtain the specific patch number for your release from the CPU matrix. Until patching, reduce exposure by restricting network access to the Content Server so it is not reachable from untrusted networks or the internet - front it with a reverse proxy or WAF and limit HTTP access to known internal ranges and VPN users (trade-off: may break external partner or remote-user access to content). Because exploitation requires user interaction, reinforce user-awareness controls against malicious links and untrusted content, and monitor Content Server HTTP logs for anomalous requests. These are compensating controls only; the Oracle CPU patch is the definitive remediation.