What is the CVSS score of CVE-2026-60640?

CVE-2026-60640 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60640?

A critical vulnerability in Oracle WebCenter Content Server (Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0) permits complete remote system takeover with no vendor patch available.

How to fix or mitigate CVE-2026-60640?

Within 24 hours, identify all Oracle Fusion Middleware systems running WebCenter Content versions 12.2.1.4.0 or 14.1.2.0.0, document business criticality and data sensitivity, and implement emergency network segmentation to restrict public access to affected servers. Within 7 days, deploy Content Server activity monitoring and alerting, implement email and web security controls to block potential attack delivery, and conduct security awareness training for users on social engineering tactics targeting content management systems. Within 30 days, apply vendor-released patches to all identified systems immediately upon availability, validate successful remediation, and conduct a security assessment to determine if any systems were previously exploited.

Oracle WebCenter Content CVE-2026-60640

EUVD-2026-46999 HIGH

Improper Input Validation (CWE-20)

2026-07-21 secalert_us@oracle.com

GHSA-7qj4-jvhw-6jc5

Information Disclosure Oracle Webcenter Content

8.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Unauthenticated HTTP reach (AV:N/PR:N) but Oracle-stated difficulty and required victim interaction force AC:H/UI:R; full takeover plus impact on other products gives S:C and C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:14 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.3

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle WebCenter Content (Content Server component) is possible when a remote, unauthenticated attacker lures a legitimate user into interacting with a malicious HTTP request, yielding high confidentiality, integrity, and availability impact plus a scope change to adjacent products. It affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 score of 8.3. No public exploit identified at time of analysis and it is not listed in CISA KEV, though exploitation complexity is high.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform within Oracle Fusion Middleware used for document management, imaging, and records management; the affected element is the Content Server, its core repository and delivery engine that handles HTTP-based document requests, metadata, and rendering. Oracle did not assign a CWE (listed as N/A), so the precise root-cause class is not published, but the tag 'Information Disclosure' combined with a required user-interaction, scope-changing HTTP attack is consistent with a client-side or server-side request-handling flaw (e.g., XXE/SSRF, unsafe deserialization, or a rendering/parsing weakness) that lets attacker-influenced content cross a trust boundary into other components. No CPE strings were provided in the input; affected products are identified from the Oracle advisory and ENISA EUVD version list rather than NVD CPE data.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and vendor-confirmed remediation for both 12.2.1.4.0 and 14.1.2.0.0; Oracle does not publish a standalone semantic fix version, so the CPU patch level is the exact reference to deploy (Patch available per vendor advisory). Because exploitation requires a victim to interact with attacker-supplied HTTP content, compensating controls until patching completes include restricting external network exposure of the Content Server by placing it behind a reverse proxy or WAF that filters malformed content requests, limiting Content Server access to trusted internal networks or VPN (trade-off: may break legitimate external partner document access), and user-awareness measures given the required human interaction. Because the flaw yields a scope change into additional products, also review and segment downstream systems that consume WebCenter content so a compromise cannot pivot freely (trade-off: added integration/testing overhead).