What is the CVSS score of CVE-2026-60649?

CVE-2026-60649 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60649?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical unauthenticated authentication bypass (CVSS 9.1) enabling remote attackers to read, create, delete, and modify all data…

How to fix or mitigate CVE-2026-60649?

Within 24 hours: Identify and inventory all systems running Oracle WebCenter Content versions 12.2.1.4.0 or 14.1.2.0.0, prioritizing internet-facing instances. Within 7 days: Implement network-level access controls restricting HTTP/HTTPS traffic to trusted internal networks only, deploy reverse proxy with enforced authentication, and activate detailed HTTP request logging. Within 30 days: Monitor Oracle's October 2026 Critical Patch Update for vendor remediation; upon patch release, validate and deploy immediately. If no patch emerges, execute full remediation including network air-gapping or product replacement.

Oracle WebCenter Content CVE-2026-60649

EUVD-2026-47008 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-5c4x-mhqw-ch22

Authentication Bypass Oracle Webcenter Content

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Remote unauthenticated HTTP authentication bypass with no user interaction (AV:N/AC:L/PR:N/UI:N); full read/write of accessible data (C:H/I:H) but no availability impact (A:N), scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:10 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware Web Content Management component) lets a remote attacker read, create, delete, or modify all data accessible to the product over HTTP with no credentials or user interaction. Oracle rates it CVSS 9.1 (C:H/I:H) and vendor tags describe it as an authentication bypass, making it a high-priority patch from the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform within Oracle Fusion Middleware, typically deployed on WebLogic Server and exposed via HTTP-based content services and web interfaces. The affected component is Web Content Management, which handles authoring, storage, and delivery of managed content. The vendor tag 'Authentication Bypass' indicates the root cause class is a broken or missing authentication/authorization check (conceptually CWE-287/CWE-306) that allows requests to reach privileged content operations without valid credentials; NVD lists CWE as N/A, so the exact weakness is not formally classified. Because the flaw yields both confidentiality and integrity impact but no availability impact, the underlying issue is access-control over data operations rather than a memory-safety or denial-of-service defect.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected 12.2.1.4.0 and 14.1.2.0.0 branches - this is Patch available per vendor advisory, as Oracle CPUs ship cumulative patches but the input does not include a distinct fixed build number, so confirm the exact patch/bundle ID from the CPU advisory for your version. Until patching is complete, reduce exposure by restricting network access to WebCenter Content HTTP endpoints so they are not reachable from the internet or untrusted networks (place behind a VPN or IP allowlist), and put a WAF or reverse proxy in front of the content-management endpoints to filter anomalous requests; the trade-off is that overly aggressive filtering or access restriction can disrupt legitimate content authors and integrated applications that call these services. Because the flaw is an unauthenticated authentication bypass, host-level authentication tightening alone will not close it - the vendor patch is the only reliable fix.