What is the CVSS score of CVE-2026-60655?

CVE-2026-60655 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60655?

Oracle WebCenter Content in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 contains a high-severity vulnerability allowing low-privileged authenticated users to achieve complete product…

How to fix or mitigate CVE-2026-60655?

Within 24 hours: Identify and inventory all Oracle WebCenter Content instances in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 across production and non-production environments, document criticality and user scope. Within 7 days: Implement network segmentation to restrict WCC access to authorized systems only, enforce multi-factor authentication for all administrative accounts, and enable detailed logging of administrative activity. Within 30 days: Establish weekly monitoring of Oracle's patch release status and July 2026 Critical Patch Updates for CVE-2026-60655 remediation; develop and test a staged deployment plan for remediated versions; reassess any security gaps once patches become available.

Oracle WebCenter Content CVE-2026-60655

EUVD-2026-47016 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-r46j-gcjf-xq25

Authentication Bypass Oracle Webcenter Content

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach with low complexity and no interaction, but a valid low-privilege account is required (PR:L), and full product takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:08 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Privilege-based full compromise of Oracle WebCenter Content (Web Content Management component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-authenticated attacker take over the entire product over HTTP. Oracle rates it CVSS 3.1 8.8 with High confidentiality, integrity, and availability impact, and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and 'takeover' outcome make it a high-priority patch in the July 2026 Oracle Critical Patch Update.

Technical ContextAI

Oracle WebCenter Content is an enterprise content and document management platform within Oracle Fusion Middleware, typically deployed on WebLogic Server as part of the Oracle content/imaging stack. The affected component is Web Content Management, the subsystem handling authored/published web content. Oracle assigned no CWE, so the exact weakness class (e.g., injection, deserialization, access control, or SSRF) is not disclosed; Oracle CPU advisories characteristically omit technical root-cause detail. The 'takeover' language combined with S:U (unchanged scope) indicates the attacker gains full control of the WebCenter Content application context itself rather than pivoting to the underlying OS or adjacent WebLogic domains.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 lines; the CPU notes provide the exact patch/bundle identifiers per version - apply the corresponding CPU patch as the primary fix. No exact standalone fix version string was provided in this input, so treat the July 2026 CPU as the patch reference: patch available per vendor advisory. Until patched, reduce exposure by restricting network access to the WebCenter Content HTTP endpoints to trusted internal networks or VPN, tightening account provisioning to remove unnecessary low-privilege accounts and disabling any self-registration, and enforcing strong authentication (MFA) on all WebCenter users since PR:L means any valid account is a viable launch point. These controls reduce the pool of potential attackers but do not eliminate risk from a compromised legitimate credential, so patching remains essential.