What is the CVSS score of CVE-2026-60639?

CVE-2026-60639 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60639?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical remote vulnerability (CVSS 8.8) enabling complete system compromise if an attacker successfully delivers malicious…

How to fix or mitigate CVE-2026-60639?

Within 24 hours: Execute targeted discovery to identify all Oracle WebCenter Content deployments running versions 12.2.1.4.0 or 14.1.2.0.0, document business criticality, and enumerate authenticated user populations. Within 7 days: Deploy email and web filtering rules to block malicious attachments and links targeting WebCenter Content, restrict administrative access to affected systems, and brief users on this attack vector through targeted security awareness. Within 30 days: Establish comprehensive audit logging for WebCenter Content activity, monitor Oracle security advisories for patch availability, and create a prioritized upgrade plan to migrate critical systems to patched versions once available.

Oracle WebCenter Content CVE-2026-60639

EUVD-2026-46997 HIGH

Improper Input Validation (CWE-20)

2026-07-21 secalert_us@oracle.com

GHSA-m9r4-m9fh-4m2p

Information Disclosure Oracle Webcenter Content

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Unauthenticated network HTTP vector with low complexity but mandatory victim interaction (UI:R) and full takeover, matching Oracle's stated impact and confirming C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:14 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle WebCenter Content (Content Server component) in Oracle Fusion Middleware allows a remote unauthenticated attacker to fully compromise confidentiality, integrity, and availability, but only after luring an authenticated victim into interacting with an attacker-supplied trigger (UI:R). It affects supported versions 12.2.1.4.0 and 14.1.2.0.0, carries a CVSS 3.1 base score of 8.8, and is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform used to store, manage, and deliver documents, records, and digital assets; the vulnerable Content Server component is the core repository/web engine that processes HTTP requests to serve and manipulate content. The flaw is reachable over HTTP without authentication but requires the action of a second human, which is a signature pattern of client-side vectors such as cross-site request forgery, reflected/stored injection, or a crafted link/document that a logged-in user must open. Oracle does not publish CWE identifiers in its Critical Patch Update advisories, so the exact root-cause class is not enumerated here (CWE: N/A); the Oracle-applied tag 'Information Disclosure' plus C:H/I:H/A:H indicate the outcome goes well beyond simple disclosure, up to complete product takeover.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor-released patch covering the affected 12.2.1.4.0 and 14.1.2.0.0 branches; Oracle does not ship interim patches outside the CPU, so upgrading via the CPU is the primary and expected fix. Because exploitation requires a logged-in user to interact with attacker-controlled input, compensating controls until patching include restricting Content Server web access to trusted networks or VPN, placing a WAF/reverse proxy in front to filter crafted requests, and enforcing strict same-site/anti-CSRF and referrer controls (trade-off: may break legitimate cross-origin integrations or embedded viewers); additionally, security-awareness guidance to staff about opening unexpected links or documents in WebCenter reduces the human-interaction trigger, though it is not a substitute for the patch.