What is the CVSS score of CVE-2026-60650?

CVE-2026-60650 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60650?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability enabling full account and instance takeover by any authenticated user, resulting in complete compromise of…

How to fix or mitigate CVE-2026-60650?

Within 24 hours: Inventory all Oracle WebCenter Content deployments and identify affected versions 12.2.1.4.0 and 14.1.2.0.0; assess whether instances contain sensitive data or support critical business functions. Within 7 days: Implement network-layer access controls to restrict WebCenter Content connections to essential business users only, enforce multi-factor authentication on all product accounts, and enable comprehensive audit logging of all authentication and administrative events. Within 30 days: Establish priority contact with Oracle to confirm patch timeline; if vendor patch does not reach stable release within 60 days, evaluate alternative content management platforms or temporary service shutdown.

Oracle WebCenter Content CVE-2026-60650

EUVD-2026-47009 HIGH

Improper Input Validation (CWE-20)

2026-07-21 secalert_us@oracle.com

GHSA-q2h6-cjcp-39qg

Information Disclosure Oracle Webcenter Content

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Network HTTP reachable and low complexity, but needs a low-privilege account (PR:L) and a second user's interaction (UI:R); full takeover gives C/I/A High, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:10 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.0

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Account/instance takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the product after luring a victim user into an action. Oracle rates it CVSS 3.1 8.0 with High impact to confidentiality, integrity, and availability, and the ecalert tag flags Information Disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebCenter Content is the enterprise content/document management (ECM) platform within Oracle Fusion Middleware, used for managing web content, records, and digital assets. The flaw resides in the Web Content Management component, which handles authoring and delivery of web content over HTTP. Oracle publishes no CWE for this entry, but the combination of low-privilege access, required user interaction, and full compromise is consistent with a session/action-riding or stored-content injection class of issue (e.g., an authenticated attacker planting malicious content or a request that a privileged victim then triggers). Exact CPE strings are not provided in the input; affected builds are the Fusion Middleware release trains 12.2.1.4.0 and 14.1.2.0.0.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html); Oracle distributes these as cumulative CPU patch bundles for the 12.2.1.4.0 and 14.1.2.0.0 trains rather than a single named point release, so identify and apply the WebCenter Content CPU patch matching your installed version. Until patching, reduce exposure by restricting network access to the WebCenter Content HTTP endpoints to trusted internal users via network ACLs or a reverse proxy/WAF (trade-off: may block legitimate remote authoring), tightening account privileges so fewer low-privilege accounts exist to abuse PR:L, and educating privileged users to avoid interacting with untrusted links/content to blunt the required UI:R step. These are compensating controls only; the CPU patch is the definitive fix.