What is the CVSS score of CVE-2026-60645?

CVE-2026-60645 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60645?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a privilege escalation vulnerability enabling complete system compromise including data theft and service disruption for attackers…

How to fix or mitigate CVE-2026-60645?

Within 24 hours, identify all systems running Oracle WebCenter Content versions 12.2.1.4.0 or 14.1.2.0.0 and audit which accounts hold high administrative privileges with HTTP network access. Within 7 days, deploy the Oracle Critical Patch Update released in July 2026 to all affected instances, prioritizing production systems first. Within 30 days, complete patching of all remaining systems, verify successful patch deployment through post-update validation testing, and review access logs from the past 90 days for any evidence of privilege escalation attempts or suspicious administrative activity.

Oracle WebCenter Content CVE-2026-60645

EUVD-2026-47004 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-xv6g-7m46-f927

Authentication Bypass Oracle Webcenter Content

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

HTTP network vector with low complexity but requiring existing high privileges (PR:H), yielding full confidentiality, integrity, and availability compromise on an unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:22 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Content (Fusion Middleware, Web Content Management component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with HTTP network access can escalate to complete takeover of the product with confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable, though it requires existing high privileges. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform within Oracle Fusion Middleware, used to store, manage, and deliver documents and web content; the flaw resides specifically in its Web Content Management subcomponent, which handles publishing and rendering of managed web content. The affected releases are the 12.2.1.4.0 (12c) and 14.1.2.0.0 (14c) branches. Oracle did not assign a CWE (listed as N/A) and its advisory text is deliberately sparse, so the precise root-cause class is not disclosed; the Oracle-supplied tag 'Information Disclosure' plus the C:H/I:H/A:H impact and 'takeover' language suggest an authenticated flaw that lets an already-privileged user break out of intended authorization boundaries to fully control the application.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html) - Oracle does not publish a separate point-release version string for CPU fixes, so apply the CPU bundle patch corresponding to your 12.2.1.4.0 or 14.1.2.0.0 installation; no independently confirmed standalone fix version is available beyond the CPU. As compensating controls until patching, restrict and audit high-privilege WebCenter Content accounts since exploitation requires PR:H (rotate credentials, remove unnecessary admin/manager roles, enforce MFA on privileged logins), and place the WebCenter Content HTTP interface behind network segmentation or a reverse proxy that limits administrative access to trusted management networks - the trade-off is potential disruption to legitimate remote administration and content-management workflows that must then be routed through the allowed paths.