What is the CVSS score of CVE-2026-60647?

CVE-2026-60647 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60647?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a sensitive data disclosure vulnerability allowing authenticated low-privileged attackers to access organization-wide data and…

How to fix or mitigate CVE-2026-60647?

Within 24 hours, identify all systems running Oracle WebCenter Content 12.2.1.4.0 or 14.1.2.0.0 and implement network access restrictions limiting connectivity to trusted administrative networks only; disable HTTP access if TLS is supported and require authentication re-verification for all active sessions. Within 7 days, complete an inventory of sensitive data accessible through WebCenter Content, implement enhanced monitoring for anomalous data access patterns, and establish a patch readiness plan including test environment preparation. Within 30 days, monitor Oracle's security advisories for patch availability; upon release, prioritize testing in a production-equivalent environment and deploy to all affected systems within 2 weeks of validation.

Oracle WebCenter Content CVE-2026-60647

EUVD-2026-47006 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-43r2-pvj9-5h7x

Authentication Bypass Denial Of Service Information Disclosure Oracle Webcenter Content

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Network HTTP with low complexity but requires a low-privileged account (PR:L); high confidentiality loss, no integrity impact, and only partial DoS (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:11 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Content. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).

AnalysisAI

Sensitive data disclosure in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) lets a low-privileged, network-based attacker read or fully access all data the application can reach and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 7.1 and describes it as easily exploitable, though it requires an existing low-level account (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management (ECM) and Web Content Management (WCM) platform within Oracle Fusion Middleware, used to store, manage, and deliver documents and web assets over HTTP-based services. The affected 'Web Content Management' component handles content authoring and delivery. Oracle does not publish a CWE for this issue (CWE: N/A) and gives no root-cause class; the CVSS profile (confidentiality High, integrity None, availability Low) together with Oracle's language about 'unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data' points to a broken-access-control or authorization-bypass style flaw where a low-privileged session can reach data beyond its intended scope, rather than a memory-corruption or code-execution defect. The vendor-supplied tags 'Authentication Bypass' and 'Denial Of Service' reinforce an access-control interpretation, but no exact CWE or affected subcomponent is confirmed.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch set applicable to WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 - Patch available per vendor advisory, though the input does not name a specific fixed build number, so identify the precise patch from the CPU matrix. Because exploitation requires a low-privileged account, interim compensating controls include restricting network access to the WebCenter Content HTTP endpoints to trusted management networks or via VPN, tightening account provisioning and auditing existing low-privileged accounts, and placing a WAF/reverse proxy in front of the content management interfaces to monitor and rate-limit anomalous requests (trade-off: WAF rules may need tuning to avoid breaking legitimate content-authoring workflows, and network restrictions can impede remote authors). These controls reduce exposure but do not eliminate the flaw; patching per the July 2026 CPU is the definitive remediation.