What is the CVSS score of CVE-2026-60651?

CVE-2026-60651 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60651?

A critical vulnerability in Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) enables complete system compromise through remote social engineering attacks, granting unauthorized access to…

How to fix or mitigate CVE-2026-60651?

Within 24 hours, identify all systems running Oracle WebCenter Content versions 12.2.1.4.0 or 14.1.2.0.0, map their network exposure and user populations, and document business criticality. Within 7 days, implement Web Application Firewall rules to detect malicious content payloads, restrict platform access to trusted IP ranges and users, enforce HTTPS-only connectivity, and enable detailed transaction and access logging with real-time alerting. Within 30 days, engage Oracle support for patch availability status and any interim compensating controls, prepare and test emergency patch deployment procedures for immediate execution upon release, and establish dedicated monitoring for exploitation attempts targeting CVE-2026-60651.

Oracle WebCenter Content CVE-2026-60651

EUVD-2026-47010 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-p82c-jw37-7f5r

Authentication Bypass Oracle Webcenter Content

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable and unauthenticated (AV:N/PR:N) but gated by required victim interaction (UI:R); full takeover justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:10 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle WebCenter Content (Web Content Management component) is possible when a remote, unauthenticated attacker lures a victim into interacting with malicious content over HTTP. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Oracle's own Critical Patch Update process (July 2026).

Technical ContextAI

Oracle WebCenter Content is the enterprise content/document management platform within Oracle Fusion Middleware, used for managing, storing, and publishing web and document content. The vulnerable Web Content Management component processes HTTP-delivered content that is rendered or acted upon in a user's session, and the requirement for human interaction (UI:R) with an unchanged scope (S:U) is consistent with a client-side-triggered server compromise - for example a crafted link, page, or content item that, when opened by a privileged user, drives a state-changing action against the server. Oracle did not assign a CWE (CWE: N/A), so the precise weakness class (e.g., XSS-to-takeover, request forgery, or deserialization triggered via interaction) cannot be confirmed from the available data; the Information Disclosure tag suggests a data-exposure element, though the C:H/I:H/A:H vector indicates impact well beyond disclosure alone.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor's remediation channel for both affected releases (12.2.1.4.0 and 14.1.2.0.0); Patch available per vendor advisory, but no discrete fixed build number was included in the provided data, so identify the exact patch set for your version directly from the CPU matrix. Because exploitation depends on a user interacting with attacker-supplied content, interim compensating controls include restricting network exposure of the WebCenter Content HTTP interface to trusted internal networks or via VPN/reverse-proxy allow-listing (trade-off: may break legitimate external content delivery), and hardening browser/session handling and user awareness for content authors and administrators who would be the interaction targets (trade-off: reduces likelihood but does not remove the flaw). Do not treat workarounds as a substitute for the CPU patch, which is the only confirmed fix.