What is the CVSS score of CVE-2026-60646?

CVE-2026-60646 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60646?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a high-severity vulnerability enabling complete account takeover when attackers with low-privileged access convince users to…

How to fix or mitigate CVE-2026-60646?

Within 24 hours, inventory all instances of Oracle WebCenter Content running versions 12.2.1.4.0 or 14.1.2.0.0 and restrict network access to these systems to essential business users only; activate enhanced monitoring for suspicious authentication patterns and anomalous content access attempts. Within 7 days, enforce multi-factor authentication on all WebCenter Content user accounts, conduct security awareness training focused on social engineering and phishing tactics that could trigger this vulnerability, and begin formal evaluation of upgrade paths with application stakeholders and IT leadership. Within 30 days, contact Oracle support to confirm patch timeline and availability, prioritize upgrades starting in non-production environments, coordinate production deployment schedules, and deploy or enhance endpoint detection and response (EDR) solutions to detect exploitation attempts across affected infrastructure.

Oracle WebCenter Content CVE-2026-60646

EUVD-2026-47005 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-21 secalert_us@oracle.com

GHSA-fgcw-7q8j-37w2

XSS Oracle Webcenter Content

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Remote HTTP attack (AV:N/AC:L) needs an authenticated low-priv account (PR:L) and a second user's interaction (UI:R); full takeover gives C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:22 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.0

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Content (Fusion Middleware, Web Content Management component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged, network-authenticated attacker who lures a victim into a triggering action can achieve complete takeover of the product with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). Oracle rates the flaw as easily exploitable over HTTP but conditions it on human interaction from a second party. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Content is an enterprise content and document management platform within the Oracle Fusion Middleware stack, and the affected component is Web Content Management, which handles authoring, storing, and rendering of web content. The vulnerability is exposed over HTTP and requires an authenticated session, indicating the flaw resides in an application-tier feature reachable by legitimate low-privilege users. No CWE was assigned in the input, so the precise root-cause class is unconfirmed; Oracle's own tagging labels it 'Information Disclosure,' but the CVSS vector reports High impact across Confidentiality, Integrity, and Availability, which points to a takeover-class weakness broader than pure disclosure - the discrepancy should be verified against Oracle's advisory.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (Patch available per vendor advisory) referenced at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle distributes these as CPU bundle patches for WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 rather than as a single renamed version, so identify and deploy the specific CPU-July-2026 patch for your installed release. No exact standalone fix version was provided in the input, so consult the CPU advisory patch matrix for the precise patch number for your platform. As compensating controls until patching, restrict network reachability of the WebCenter Content HTTP endpoints to trusted internal networks or place them behind a VPN/reverse proxy with strict access lists (trade-off: may break legitimate external content authoring workflows); tighten account provisioning and review low-privilege user accounts since exploitation requires an authenticated session; and, because the attack depends on human interaction, brief content authors and reviewers on not opening or acting on untrusted content or links within the application (trade-off: awareness measures reduce but do not eliminate the risk).