What is the CVSS score of CVE-2026-60657?

CVE-2026-60657 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60657?

Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) contains a vulnerability enabling unauthorized data access and modification through social-engineering attacks.

How to fix or mitigate CVE-2026-60657?

Within 24 hours: inventory all Oracle WebCenter Content instances and identify which run vulnerable versions (12.2.1.4.0 or 14.1.2.0.0); assess which systems integrate with WebCenter to map potential blast radius; consider temporarily disabling non-critical WebCenter services. Within 7 days: restrict network access to WebCenter Content through firewall rules and IP whitelisting; implement enhanced monitoring for suspicious data access and modifications; provide targeted user awareness training on social-engineering and phishing tactics. Within 30 days: establish monitoring for Oracle security advisory releases; validate patch compatibility and deployment procedures for your environment; schedule coordinated patching of all affected WebCenter instances with change management approval.

Oracle WebCenter Content CVE-2026-60657

EUVD-2026-47018 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-2f4m-v4jj-hpx5

Authentication Bypass Oracle Webcenter Content

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

7.7 HIGH

Network HTTP with a low-priv account (AV:N/PR:L) but hard to exploit and needing a third party's interaction (AC:H/UI:R); scope change with high C/I and no availability impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:01 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N).

AnalysisAI

Cross-context data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-reachable attacker read and alter critical data after tricking a legitimate user into interacting with malicious content. Because the flaw crosses a security scope boundary (S:C), successful attacks can significantly impact products beyond WebCenter Content itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.7; no public exploit identified at time of analysis.

Technical ContextAI

Oracle WebCenter Content (formerly Universal Content Management/Stellent) is an enterprise content and document management platform; the affected Content Server component handles ingestion, storage, retrieval, and rendering of managed documents over HTTP. The scope-change nature (S:C) combined with the vendor tag 'Authentication Bypass' and the required third-party user interaction is consistent with a client-side injection or cross-site style class of flaw, where attacker-controlled content is processed in a victim's authenticated context and lets actions cross a trust boundary into other Fusion Middleware components. Oracle assigned no CWE (CWE: N/A), so the precise root-cause class cannot be confirmed from the input; the 'Authentication Bypass' tag suggests the victim's session or authority is leveraged rather than the attacker's own low privileges.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; the CPU does not publish a single discrete fix-version string in this input, so consult the CPU patch matrix for the exact patch or bundle matching your 12.2.1.4.0 or 14.1.2.0.0 installation and apply it. Because exploitation requires a victim to interact with attacker-supplied content, compensating controls while patching include restricting network exposure of the Content Server HTTP interface to trusted networks or placing it behind a VPN/reverse proxy, tightening account provisioning so untrusted parties cannot obtain the low-privilege access the attack needs, and enabling stricter content-handling and response-header policies on the WebCenter front end to blunt client-side injection (trade-off: proxy or header changes may break legitimate document-rendering integrations and require regression testing). User-awareness measures reduce the UI:R trigger but do not eliminate the flaw.