What is the CVSS score of CVE-2026-60663?

CVE-2026-60663 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60663?

Oracle WebCenter Content deployments face a CRITICAL privilege escalation vulnerability (CVSS 9.9) allowing low-privileged users to gain complete control of affected servers, with potential lateral…

How to fix or mitigate CVE-2026-60663?

Within 24 hours, inventory all Oracle WebCenter Content instances and restrict HTTP/HTTPS access to trusted networks only via firewall rules; immediately disable low-privileged user accounts not essential to business operations. Within 7 days, implement network segmentation isolating WebCenter Content systems, deploy real-time alerting for privilege escalation attempts and anomalous authentication activity, and enforce multi-factor authentication for all administrative functions. Within 30 days, establish weekly contact with Oracle to track CVE-2026-60663 patch status, conduct a comprehensive privilege access review to eliminate unnecessary low-privilege accounts, and evaluate alternative content management platforms or temporary service suspension if patches remain unavailable beyond 30 days.

Oracle WebCenter Content CVE-2026-60663

EUVD-2026-47022 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-m234-qf72-hx24

Privilege Escalation Oracle Webcenter Content

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Remote HTTP with low-privilege account (AV:N/AC:L/PR:L/UI:N); scope change to adjacent middleware (S:C) with full takeover yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:58 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation to full takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) lets a low-privileged, network-based attacker fully compromise the server over HTTP. Because the CVSS vector marks a scope change (S:C), a successful attack can significantly impact additional products beyond WebCenter Content itself, driving the near-maximal 9.9 base score. No public exploit identified at time of analysis, but the ease of exploitation (AC:L, PR:L) and complete confidentiality, integrity, and availability impact make this a top-priority patch in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebCenter Content is the enterprise content and document management platform within Oracle Fusion Middleware, typically deployed on top of Oracle WebLogic Server and used to store, manage, and publish web and business content. The affected element is the Web Content Management component. Oracle did not assign a CWE (CWE: N/A) and does not disclose the specific defect class, but the CVSS profile - network HTTP vector, low privilege, and a scope change leading to takeover - is characteristic of an authorization or injection-style flaw that lets an authenticated low-privilege user break out of their intended context. The scope change (S:C) indicates the vulnerable WebCenter component can act on resources managed by a separate security authority, such as the underlying WebLogic domain or connected middleware services.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026, documented at https://www.oracle.com/security-alerts/cpujul2026.html, which is the primary and vendor-supported remediation for both affected releases (12.2.1.4.0 and 14.1.2.0.0); Oracle does not publish a separate standalone fix version, so the CPU patch level is the exact target. Because exploitation requires a low-privileged authenticated account and HTTP reachability, interim compensating controls until patching include restricting network access to the WebCenter Content HTTP endpoints to trusted management networks or via a reverse proxy/WAF, tightening and auditing low-privilege application accounts to reduce the pool of usable footholds, and enforcing least privilege on the WebLogic domain the component runs in; note that network restrictions may break legitimate remote content contributors and integrations, so validate access paths before enforcing. Given the scope change, also review and segment adjacent middleware services that could be affected downstream.