What is the CVSS score of CVE-2026-60664?

CVE-2026-60664 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-60664?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical unauthenticated remote code execution vulnerability enabling full system compromise through social engineering attacks…

How to fix or mitigate CVE-2026-60664?

Within 24 hours: Identify and isolate all instances of WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0; apply network segmentation to restrict access from untrusted sources and limit connectivity to essential business systems only. Within 7 days: Deploy Web Application Firewall rules to detect malicious HTTP traffic targeting WebCenter Content; launch targeted security awareness training for users who interact with WebCenter Content; contact Oracle support to confirm patch release timeline and alternative solutions. Within 30 days: Execute controlled upgrades to patched Oracle WebCenter Content releases when available; for systems that cannot be upgraded, disable non-critical WebCenter Content components or migrate workflows to alternative platforms; conduct verification scans to confirm vulnerability remediation and document all compensating controls deployed.

Oracle WebCenter Content CVE-2026-60664

EUVD-2026-47023 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-21 secalert_us@oracle.com

GHSA-6475-ggm6-hcp3

XSS Oracle Webcenter Content

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote unauthenticated over HTTP (AV:N/PR:N) but requires victim interaction (UI:R); results in full takeover, hence C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:58 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 is possible over HTTP by an unauthenticated remote attacker who lures a legitimate user into interacting with malicious content. Rated CVSS 3.1 8.8 with high confidentiality, integrity and availability impact, the flaw can lead to full takeover of the WebCenter Content instance. Disclosed via Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management (ECM) and document/records management platform within Oracle Fusion Middleware; the vulnerable Content Server component is the web-facing repository engine that ingests, indexes and serves documents over HTTP. The CVSS vector (AV:N combined with UI:R) together with the 'Information Disclosure' and Oracle tags points to a client-side-triggered web flaw - the required human interaction is characteristic of cross-site scripting, HTML/URL injection, or a request-forgery-style issue in the Content Server web interface rather than a purely server-side memory-corruption bug. Oracle did not assign a CWE (CWE: N/A), so the precise weakness class is not documented in the available data.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor-released remediation channel for both affected versions 12.2.1.4.0 and 14.1.2.0.0; an exact patched build number is not enumerated in the available data, so treat this as patch available per vendor advisory and pull the precise patch/bundle from the CPU matrix for your version. Because exploitation requires victim interaction with attacker-supplied content over HTTP, compensating controls until patching include restricting Content Server web access to trusted networks or a VPN, placing it behind a WAF tuned for XSS/HTML-injection and request-forgery patterns, and enforcing strict Content-Security-Policy and same-site cookie settings - with the trade-off that aggressive WAF or CSP rules can break legitimate content rendering or embedded document previews in the ECM interface. User awareness against opening untrusted WebCenter links reduces but does not eliminate risk.