What is the CVSS score of CVE-2026-60644?

CVE-2026-60644 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-60644?

Within 24 hours: identify and inventory all Oracle WebCenter Content instances running versions 12.2.1.4.0 or 14.1.2.0.0; implement emergency network isolation by restricting HTTP/HTTPS access via firewall rules to authorized administrators only; consider offline deployment if business operations permit. Within 7 days: conduct comprehensive assessment of systems dependent on or connected to affected WebCenter Content instances; review access logs for indicators of compromise; establish monitoring for authentication anomalies and file system changes; subscribe to Oracle security advisories for patch status updates. Within 30 days: apply vendor-released patch immediately upon availability, validate successful installation, carefully restore network access with enhanced monitoring, and implement lasting network segmentation between WebCenter Content and critical business systems.

Oracle WebCenter Content CVE-2026-60644

EUVD-2026-47003 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-5jm3-cwpg-c375

Authentication Bypass Oracle Webcenter Content

10.0

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach WebCenter Content HTTP interface
Delivery

Send crafted unauthenticated request
Exploit

Exploit Web Content Management flaw
Execution

Take over content server
Impact

Pivot to adjacent Fusion Middleware (scope change)

Vulnerability Assessment

Weakness	CWE CWE-306 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Authentication required for critical functions MITRE ATT&CK 1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation over HTTP against supported/default deployments of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0, per CVSS AV:N/AC:L/PR:N/UI:N. The only meaningful limiting factor is network reachability of the WebCenter Content HTTP interface: the attacker must be able to connect to the content server's HTTP(S) port, so instances confined to internal networks or behind VPN/WAF/IP allow-lists are materially harder to reach. Exploitation requires no authentication, no user interaction, and no non-default configuration according to the supplied Oracle data; only the two named supported versions are confirmed affected.
Impact	Every raw signal points to maximum priority: CVSS 3.1 base score is 10.0 with AV:N/AC:L/PR:N/UI:N - remote, low-complexity, unauthenticated, no user interaction - plus S:C scope change and full C:H/I:H/A:H impact resulting in complete takeover. Oracle itself characterizes it as 'easily exploitable.' The countervailing signals are the absence of an EPSS score, no CISA KEV listing, and no published proof-of-concept in the provided data, so there is no confirmation of active or widespread exploitation yet. This is a genuine top-tier priority rather than an inflated high-CVSS/low-real-risk item, because the product is internet-facing in many deployments and Oracle WebCenter/WebLogic flaws have a strong historical track record of rapid weaponization after CPU disclosure. No SSVC decision data was provided, and EPSS is missing - treat exploitation probability as not yet quantified, not as low.
Exploit ScenarioDerived	An attacker who can reach the WebCenter Content HTTP interface - for example an internet-exposed content server - sends a single crafted, unauthenticated HTTP request to the Web Content Management component and, with no credentials or user interaction, achieves full takeover of the server. Owing to the scope change, the attacker leverages that foothold to reach adjacent Oracle Fusion Middleware resources. No public proof-of-concept was identified at time of analysis, but the low attack complexity makes reliable exploitation straightforward once technical details emerge.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Full takeover of Oracle WebCenter Content (Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthenticated remote attacker over HTTP, requiring no user interaction. The scope-changing flaw (CVSS 3.1 base 10.0) lets attackers compromise the Web Content Management component and pivot to impact adjacent Oracle products. No public exploit identified at time of analysis, but the maximum severity and trivial exploitability make this a top-priority patch from the July 2026 Oracle Critical Patch Update.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update immediately; the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html is the source for the exact patch bundle for versions 12.2.1.4.0 and 14.1.2.0.0 (Patch available per vendor advisory - no standalone fixed build number was provided in the input, so obtain the specific patch ID from the CPU matrix). Because the flaw is unauthenticated and network-reachable over HTTP, until patching is complete restrict network exposure by placing WebCenter Content behind a VPN or IP allow-list, blocking direct internet access to the content server HTTP/HTTPS ports, and inspecting or filtering requests to the Web Content Management endpoints at a WAF or reverse proxy - accepting that these controls may disrupt legitimate external content delivery and remote author access. Given the scope change, also review and harden the trust boundary between WebCenter Content and any co-hosted Fusion Middleware/WebLogic components to limit lateral impact, and audit logs for anomalous unauthenticated HTTP activity.

Affected VersionsENISA

Oracle WebCenter Content 12.2.1.4.0

Oracle WebCenter Content 14.1.2.0.0

Affected Packages

euvd oracle_webcenter_content no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle WebCenter Content is an enterprise content management (ECM) platform within Oracle Fusion Middleware, used to store, manage, and deliver digital assets and web content, typically deployed on WebLogic Server. The vulnerable component is Web Content Management, exposed over HTTP. Oracle did not assign a CWE (listed as N/A) and, per its standard CPU disclosure practice, withholds root-cause detail; however, the AV:N/AC:L/PR:N/UI:N vector combined with a full-takeover impact and scope change is characteristic of authentication-bypass or unauthenticated remote-code-execution/injection classes common to WebCenter/WebLogic (e.g. deserialization or SSRF/path-based flaws). The scope change (S:C) indicates the vulnerable component can affect resources beyond its own security authority, consistent with a WebLogic-hosted service reaching underlying OS or other Fusion Middleware components.

Know when Webcenter Content gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI 10.0 CRITICAL

Oracle confirms unauthenticated HTTP-reachable full takeover with cross-product impact, so AV:N/AC:L/PR:N/UI:N, scope change S:C, and full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 face a critical remote-access vulnerability enabling attackers to seize complete control without authentication or user interaction, with no public exploit identified at time of analysis. Compromised instances could become beachheads for attacking connected Oracle systems and accessing sensitive enterprise data. Organizations using these versions must immediately identify and contain affected systems to prevent breach propagation.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim risk-reduction measures: enforce strict firewall and Web Application Firewall rules restricting WebCenter Content ports to authorized administrators; deploy detection-focused monitoring for authentication irregularities and suspicious file modifications; isolate affected systems from critical infrastructure to contain potential lateral movement; maintain vigilant surveillance of Oracle security advisories for patch release notifications.

Threat Intelligence Overview

EPSS Score

0.4%

Top 72% exploitable

Prevalence

Medium

enterprise Oracle ECM, common in large orgs but not ubiquitous

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.