What is the CVSS score of CVE-2026-60653?

CVE-2026-60653 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60653?

Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) contains a data compromise vulnerability allowing low-privileged attackers with HTTP access to read, modify, create, or delete all…

How to fix or mitigate CVE-2026-60653?

Within 24 hours: Identify and inventory all Oracle WebCenter Content instances running versions 12.2.1.4.0 or 14.1.2.0.0 and document network accessibility (internal vs. Internet-facing). Within 7 days: Apply the July 2026 Oracle Critical Patch Update to all affected instances and validate successful deployment. Within 30 days: Complete post-patch verification, audit content-server access logs for anomalies dated prior to patching, and confirm no unauthorized content modifications.

Oracle WebCenter Content CVE-2026-60653

EUVD-2026-47013 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-j3f8-xfcx-g9ff

Authentication Bypass Oracle Webcenter Content

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach with low complexity and a low-privileged account (PR:L, not PR:N since a foothold is required); full C/I compromise of content data but no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:09 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle WebCenter Content (Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to read, create, modify, or delete all content-server-accessible data. Oracle rates this 8.1 (High) with confidentiality and integrity fully impacted but no availability effect, and the intelligence tags flag an authentication-bypass angle. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the July 2026 Oracle Critical Patch Update.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management (ECM) platform within Oracle Fusion Middleware, used for document management, digital asset management, and web content publishing; the affected element is the Web Content Management component that renders and administers published content over HTTP. Because the CVSS vector is AV:N/AC:L/PR:L with high confidentiality and integrity impact and no availability impact, the flaw behaves as a broken access-control / authorization weakness (consistent with the 'Authentication Bypass' intelligence tag) rather than a memory-corruption or denial-of-service bug - an authenticated but low-privileged principal is able to reach data and operations that should require higher authorization. Oracle assigned no CWE (CWE: N/A), so the precise root-cause class (e.g., missing function-level authorization vs. improper authentication) is not formally classified in the available data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory; an exact patched build string was not included in the input) by following https://www.oracle.com/security-alerts/cpujul2026.html for the CPU patch bundles corresponding to WebCenter Content 12.2.1.4.0 and 14.1.2.0.0. Because no standalone fixed version number is stated in the provided data, confirm the precise patch/bundle number in the CPU matrix before deployment rather than assuming one. Until patched, reduce exposure with concrete compensating controls: restrict network reachability of the Content Server and its HTTP/Web Content Management endpoints to trusted management networks or behind a VPN (trade-off: may break legitimate external content consumers and integrations), tighten authorization so low-privileged and self-registered accounts cannot reach content administration functions and audit/prune unnecessary low-privilege accounts (trade-off: administrative review effort and possible workflow disruption), and place a WAF/reverse proxy in front to constrain and log access to WCM management URLs (trade-off: tuning needed to avoid blocking valid requests). These are mitigations only and do not replace the CPU patch.