What is the CVSS score of CVE-2026-60656?

CVE-2026-60656 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60656?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical privilege escalation flaw allowing any low-privileged user to achieve complete system compromise, threatening…

How to fix or mitigate CVE-2026-60656?

Within 24 hours: Inventory all Oracle WebCenter Content instances and confirm presence of versions 12.2.1.4.0 and 14.1.2.0.0; implement network segmentation to restrict access to affected systems and monitor for suspicious HTTP requests. Within 7 days: Deploy enhanced audit logging on WebCenter Content to detect exploitation attempts; apply Web Application Firewall (WAF) rules to reject crafted HTTP requests; reduce user privileges to minimum required for business operations and restrict administrative access. Within 30 days: Monitor Oracle security advisories for vendor patch release; maintain systems in isolated state until official patch is available; prepare emergency change management process to deploy patch within 24 hours of availability.

Oracle WebCenter Content CVE-2026-60656

EUVD-2026-47017 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-qp57-q8mf-vhgp

Authentication Bypass Oracle Webcenter Content

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachable with low complexity and a single low privilege leading to full product takeover, so AV:N/AC:L/PR:L/UI:N with high C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:08 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Content is possible in versions 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component of Oracle Fusion Middleware), where a low-privileged, network-adjacent attacker sending crafted HTTP requests can escalate to complete takeover of the product with high confidentiality, integrity, and availability impact. Oracle rates this 8.8 (CVSS 3.1) and describes it as 'easily exploitable,' meaning any authenticated user with minimal privileges can seize the system. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'takeover' outcome make it a priority patch.

Technical ContextAI

Oracle WebCenter Content is an enterprise content-management (ECM) and digital asset platform within Oracle Fusion Middleware, typically deployed on WebLogic Server and exposed over HTTP for document ingestion, web content management, and imaging workflows. The affected component is Web Content Management, which handles authoring and rendering of managed web content. The CWE is listed as N/A by the source, so the precise flaw class is not published; however, Oracle's language of 'takeover' by a low-privileged HTTP user combined with full C/I/A impact is characteristic of an authorization/injection or deserialization-style defect common to Java/WebLogic middleware, where an authenticated request path allows an attacker to act beyond their intended privilege level. Exact affected products per Oracle and ENISA EUVD are Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0; no CPE strings were supplied in the input.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor's remediation channel for both affected releases (12.2.1.4.0 and 14.1.2.0.0); a specific standalone patched build number was not provided in the input data, so identify the exact patch for your version within the CPU. Because exploitation requires a low-privileged authenticated HTTP session, effective compensating controls until patching is complete include restricting network access to the WebCenter Content HTTP endpoints to trusted management networks or via VPN, tightening account provisioning to remove unnecessary low-privilege user accounts, and placing a WAF or reverse proxy in front of the Web Content Management interfaces to limit exposure - with the trade-off that these controls do not stop an attacker who already holds a valid low-privilege account and may disrupt legitimate content authors if access is over-restricted. Do not rely on these mitigations as a substitute for the CPU patch.