What is the CVSS score of CVE-2026-60652?

CVE-2026-60652 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60652?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability enabling complete account and system takeover when attackers deceive legitimate users into interacting…

How to fix or mitigate CVE-2026-60652?

Within 24 hours, identify all systems running WebCenter Content versions 12.2.1.4.0 or 14.1.2.0.0 and implement emergency access controls: restrict WebCenter Content access to documented business users only, enable comprehensive audit logging of all content interactions, and brief security and user awareness teams on the social engineering vector. Within 7 days, deploy user security training focused on content verification workflows, implement network segmentation to isolate WebCenter Content systems from sensitive data stores, enable multi-factor authentication for all WebCenter Content administrative accounts, and establish daily monitoring for suspicious content access patterns. Within 30 days, contact Oracle directly for patch timelines and interim guidance, evaluate temporary operational constraints such as scheduled availability windows, maintain heightened monitoring posture until patches are released and validated in your environment, and document compensating controls as formal exceptions to your baseline security posture.

Oracle WebCenter Content CVE-2026-60652

EUVD-2026-47012 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-rrw9-hq2g-mjfq

Authentication Bypass Oracle Webcenter Content

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Remote HTTP with low complexity but requires an existing low-privilege account (PR:L) and victim interaction (UI:R); Oracle's stated takeover justifies C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:09 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.0

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Account and system takeover in Oracle WebCenter Content (Fusion Middleware Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-based attacker to fully compromise the product when a legitimate user is tricked into interacting with attacker-supplied content. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.0 and full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' framing make it a high-priority patch item.

Technical ContextAI

Oracle WebCenter Content is an enterprise content and document management platform (formerly Universal Content Management / Stellent UCM), delivered as part of the Oracle Fusion Middleware stack and typically fronted by Oracle WebLogic Server. The affected 'Web Content Management' component handles authoring, rendering, and delivery of web-facing content, which routinely processes user-controlled input rendered back to other users. Oracle did not assign a CWE (CWE: N/A), but the vector - network HTTP, low privileges, required user interaction, and full compromise - combined with the 'Information Disclosure' tag is consistent with a stored/reflected injection or content-handling flaw in which content submitted by a low-privileged authenticated user is later processed or rendered in a higher-trust context, leading to takeover. Exact affected builds are the 12.2.1.4.0 and 14.1.2.0.0 release trains; no CPE strings were provided in the source data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to the affected 12.2.1.4.0 and 14.1.2.0.0 installations; Oracle ships CPU patches per release train rather than as a renamed product version, so treat 'Patch available per vendor advisory' as the fix status and pull the exact patch number for your platform from the CPU matrix, since no standalone fixed version string was provided. Because exploitation requires a low-privileged account plus victim interaction, effective compensating controls until patching are to restrict and audit who holds authoring/contributor privileges in WebCenter Content, tighten content-submission workflows and moderation so low-trust user content is not rendered to higher-privileged users unreviewed, and place the WebCenter/WebLogic HTTP endpoints behind a WAF and network access controls to limit exposure; note that aggressive content filtering or workflow moderation can delay or block legitimate publishing, so tune rules against your editorial process before enforcing.