What is the CVSS score of CVE-2026-60643?

CVE-2026-60643 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60643?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a high-severity vulnerability allowing authenticated users with low privileges to achieve complete system compromise through social…

How to fix or mitigate CVE-2026-60643?

Within 24 hours: inventory all Oracle WebCenter Content deployments to identify instances running versions 12.2.1.4.0 or 14.1.2.0.0, then immediately restrict user interactions with untrusted external content and disable embedded content previews where operationally feasible. Within 7 days: implement network segmentation to limit lateral movement from compromised WebCenter Content systems, enforce multi-factor authentication for all administrative WebCenter accounts, and conduct targeted security awareness training on social engineering threats specific to content systems. Within 30 days: escalate to Oracle support for available patches or workarounds, and plan a phased upgrade to non-vulnerable versions or alternative content management solutions if patches remain unavailable.

Oracle WebCenter Content CVE-2026-60643

EUVD-2026-47002 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-21 secalert_us@oracle.com

GHSA-gmp2-w77g-x36r

CSRF Oracle Webcenter Content

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Network HTTP reach and low complexity, but a low-privilege account (PR:L) and a separate interacting victim (UI:R) are required, with full C/I/A takeover impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:23 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.0

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Account/system takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets a low-privileged, authenticated attacker with HTTP network access fully compromise the platform, provided a legitimate user is lured into interacting with attacker-supplied content. Oracle rates it CVSS 3.1 8.0 with full Confidentiality, Integrity, and Availability loss and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'takeover' outcome and low complexity make it a high-priority patch item.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) and document management platform within Oracle Fusion Middleware; the flaw lives in its Content Server component, the core repository and web-facing service that ingests, indexes, and serves managed documents over HTTP. Because the CVSS vector requires user interaction (UI:R) and yields full takeover with only low privileges, the root cause is consistent with a web-layer injection or content-rendering issue (the Oracle tag also flags Information Disclosure) where attacker-controlled content is processed in a privileged victim's session context. Oracle assigned no CWE (CWE: N/A), so the exact weakness class is not formally categorized in the available data; the classification is inferred from the vector and impact rather than confirmed.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected WebCenter Content releases 12.2.1.4.0 and 14.1.2.0.0 - this is patch available per vendor advisory, as Oracle CPUs bundle the corrective patches rather than publishing a single standalone fixed version string in this data. Until patching, reduce exposure by restricting network access to the Content Server HTTP endpoints to trusted internal networks or VPN only (trade-off: breaks legitimate remote/partner access), placing the application behind a WAF tuned to inspect uploaded/rendered content, and tightening account provisioning so that low-privilege accounts (the PR:L prerequisite) are minimized and monitored. Because exploitation requires victim interaction, reinforce user-awareness controls around opening untrusted content within the platform. Do not treat these as substitutes for the CPU patch.