What is the CVSS score of CVE-2026-60648?

CVE-2026-60648 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60648?

Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) contains a critical vulnerability enabling full application compromise when users interact with attacker-controlled content.

How to fix or mitigate CVE-2026-60648?

Within 24 hours: identify all systems running affected Oracle WebCenter Content versions; review access logs for suspicious activity patterns from low-privileged user accounts. Within 7 days: test the Oracle Critical Patch Update (July 2026) in a staging environment, then deploy to all production systems; ensure backup systems are available in case of deployment issues. Within 30 days: conduct forensic analysis of access and modification logs to identify any prior unauthorized activity; review content that was modified or accessed by low-privileged accounts during the exposure window.

Oracle WebCenter Content CVE-2026-60648

EUVD-2026-47007 HIGH

Improper Input Validation (CWE-20)

2026-07-21 secalert_us@oracle.com

GHSA-94gx-458q-w2xc

Information Disclosure Oracle Webcenter Content

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Network HTTP reachable (AV:N/AC:L), requires a low-privileged account (PR:L) and a separate victim's interaction (UI:R); vendor states full takeover, so C/I/A all High with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:12 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.0

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full application takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-based attacker to compromise confidentiality, integrity, and availability once a legitimate user is tricked into interacting with attacker-influenced content. The flaw carries an Oracle-assigned CVSS 3.1 score of 8.0 (AV:N/AC:L/PR:L/UI:R) and is addressed in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management (ECM) platform within Oracle Fusion Middleware, used for document management, imaging, records management, and web content publishing. The affected code path is the Web Content Management component, which renders and serves managed or user-contributed content over HTTP. Oracle did not assign a CWE (CWE: N/A), but the combination of a low-privileged authenticated attacker (PR:L), required victim interaction (UI:R), a resulting full takeover, and the vendor's 'Information Disclosure' tag is consistent with a content-injection or session/authorization-abuse class flaw (for example stored cross-site scripting or a similar request-forgery style issue) where attacker-planted content executes in a higher-value user's session. The scope is unchanged (S:U), meaning the compromise stays within the WebCenter Content authorization boundary rather than pivoting into a separate system.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which contains the fix for both affected releases (12.2.1.4.0 and 14.1.2.0.0) - Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html (the provided data does not enumerate a separate fixed build number beyond the July 2026 CPU). Because exploitation requires an authenticated low-privileged user plus victim interaction, effective compensating controls until patching include restricting network access to the WebCenter Content HTTP endpoints (place behind VPN or IP allow-listing rather than exposing to the internet), tightening account provisioning and reviewing which low-privilege accounts can submit or manage web content, and enforcing strict output encoding and a Content Security Policy at any reverse proxy to blunt injected content. Trade-offs: network restriction reduces external accessibility for legitimate remote users, and CSP tuning can break legitimate embedded content if not scoped carefully. Additionally, brief users to avoid interacting with unexpected in-application content or links, since successful attacks require human interaction.