What is the CVSS score of EUVD-2026-46848?

EUVD-2026-46848 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by EUVD-2026-46848?

A vulnerability in Oracle WebCenter Content Imaging (CVE-2026-60452) allows low-privileged network attackers to read all Imaging-accessible data and modify portions of it via HTTP, creating both data…

How to fix or mitigate EUVD-2026-46848?

Within 24 hours, identify all systems running Oracle WebCenter Content Imaging and determine network exposure to untrusted attackers. Within 7 days, apply the July 2026 Critical Patch Update from Oracle to all affected WebCenter Content Imaging instances. Within 30 days, verify successful patch deployment across the entire environment, review and analyze Imaging module access logs for any suspicious data access or modification patterns that may indicate prior exploitation, and confirm security monitoring is in place to detect future exploitation attempts.

Oracle WebCenter Content EUVD-2026-46848

| CVE-2026-60452 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-98xv-gr2j-jq6q

Authentication Bypass Oracle Webcenter Content

8.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

8.5 HIGH

Network HTTP with low complexity, requires a low-privilege account (PR:L), scope change per vendor; full data read (C:H), partial modification (I:L), no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:01 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.5

DescriptionCVE.org

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebCenter Content: Imaging. While the vulnerability is in WebCenter Content: Imaging, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all WebCenter Content: Imaging accessible data as well as unauthorized update, insert or delete access to some of WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).

AnalysisAI

Privilege-abusing information disclosure and data tampering in Oracle WebCenter Content: Imaging (Core component) lets a low-privileged, network-based attacker read all Imaging-accessible data and modify some of it over HTTP. The flaw carries a scope change (CVSS 8.5), meaning a successful attack can reach beyond the Imaging module into other Fusion Middleware components, and Oracle tags it as an authentication-bypass-class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' and shipped a fix in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebCenter Content: Imaging is the document-imaging and capture module of the Oracle WebCenter Content platform, part of Oracle Fusion Middleware, used for scanning, storing, indexing and routing business documents (invoices, forms, records) via a Java/WebLogic-hosted HTTP application. The affected 'Core' component handles the imaging engine and its access-control layer. No CWE was assigned by NVD, but the Oracle-supplied 'Authentication Bypass' tag and the CVSS profile (low privileges required, high confidentiality impact, scope change) point to a broken-access-control / authorization root cause (CWE-284/CWE-285 class) where an authenticated low-privilege user can reach data and functions that should be restricted, and where the trust boundary crossed also affects adjacent WebLogic-hosted products.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which contains the fix for this issue, per Oracle advisory https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory; the CPU does not expose a single semantic fix-version string, so apply the CPU bundle patch corresponding to your installed 12.2.1.4.0 or 14.1.2.0.0 release). Because Oracle CPUs are cumulative, patch promptly and prioritize internet-exposed Imaging instances. Until patching, reduce exposure by restricting network reachability of the Imaging HTTP endpoints to trusted internal networks or via a reverse proxy/WAF (trade-off: may break legitimate remote/mobile capture clients), tightening and auditing low-privilege Imaging accounts and removing unnecessary users since exploitation requires an authenticated low-privilege foothold, and increasing logging/monitoring on Imaging access to detect anomalous cross-scope data access. These are compensating controls only and do not substitute for the CPU patch.