What is the CVSS score of CVE-2026-60654?

CVE-2026-60654 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60654?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to account takeover attacks where low-privileged users can achieve full server compromise with unrestricted access to…

How to fix or mitigate CVE-2026-60654?

Within 24 hours, catalog all Oracle WebCenter Content systems and identify which run versions 12.2.1.4.0 or 14.1.2.0.0; restrict network-level access to these systems using firewall rules, allow connections only from known trusted networks, and pull recent authentication logs for review. Within 7 days, open a priority support case with Oracle to obtain a concrete patch timeline and request interim mitigation guidance; complete a business-criticality assessment for each affected system to determine which can be isolated or disabled; if any instances are non-production, consider immediate shutdown. Within 30 days, either apply the vendor patch as soon as Oracle releases it, or work with Oracle Support to identify and validate a migration path to a non-vulnerable version of Oracle WebCenter Content.

Oracle WebCenter Content CVE-2026-60654

EUVD-2026-47014 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-hf8m-8cvr-78jg

Privilege Escalation Oracle Webcenter Content

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach with low complexity and no interaction, but a low-privilege account is required (PR:L); Oracle-described full takeover justifies C:H/I:H/A:H and scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:09 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged attacker with HTTP network access fully compromise the server. The CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management and imaging platform within Oracle Fusion Middleware, used for document management, records management, and digital asset delivery over HTTP-based web interfaces. The affected component is Web Content Management, the subsystem that renders and manages published web content. Oracle did not assign a CWE, so the precise root-cause class is not disclosed, but the vendor tag 'Information Disclosure' combined with a full C/I/A-High CVSS profile and Oracle's 'takeover' language indicates a flaw reachable by any authenticated low-privilege user that escalates to complete control of the WebCenter Content instance rather than mere data leakage.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to both the 12.2.1.4.0 and 14.1.2.0.0 branches; Oracle CPU patches are the vendor-released remediation, though an exact fixed build number was not included in the input, so confirm the precise patch bundle from the advisory. As compensating controls until patching, restrict network access to the WebCenter Content HTTP endpoints to trusted management networks or behind a VPN, tighten account provisioning so low-privilege accounts are minimized and audited (since PR:L is the key prerequisite), and enable enhanced logging/monitoring on the Web Content Management component; the trade-off is that access restrictions may disrupt legitimate content contributors and integrations that rely on broad HTTP reachability. Do not rely on workarounds long-term, as no vendor-sanctioned mitigation short of the CPU patch was published.