What is the CVSS score of EUVD-2026-47001?

EUVD-2026-47001 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Oracle WebCenter Content are affected by EUVD-2026-47001?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability enabling unauthorized access to protected content through socially engineered user interactions, with no…

How to fix or mitigate EUVD-2026-47001?

Within 24 hours, conduct a complete asset inventory of all Oracle WebCenter Content deployments, identifying systems running versions 12.2.1.4.0 or 14.1.2.0.0 and mapping their network exposure and protected content classifications. Within 7 days, restrict Content Server network access to authorized internal networks via firewall rules and IP allowlisting, disable unnecessary authentication protocols, enforce multi-factor authentication for all Content Server users, deploy targeted security awareness training on social engineering attacks, and enable detailed audit logging for access and content modification events. Within 30 days, execute an emergency upgrade plan to non-vulnerable versions or isolated staging environments, evaluate compensating control effectiveness through vulnerability scanning, and establish 24/7 monitoring for suspicious access patterns and unauthorized modifications indicative of exploitation attempts.

Oracle WebCenter Content EUVD-2026-47001

| CVE-2026-60642 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-g64c-j3p9-3chh

Authentication Bypass Denial Of Service Oracle Webcenter Content

7.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

vuln.today AI

7.6 HIGH

Remote unauthenticated over HTTP (AV:N/AC:L/PR:N) but requires victim interaction (UI:R); high data disclosure (C:H) with only partial tampering and DoS (I:L/A:L), scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:24 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.6

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Content. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L).

AnalysisAI

Unauthorized data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to gain access to critical data and cause limited data tampering and partial denial of service, provided a legitimate user is tricked into interacting with the attack. The flaw carries a CVSS 3.1 score of 7.6 and was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management (ECM) platform within Oracle Fusion Middleware, with the affected code residing in the Content Server component that handles document ingestion, retrieval, and web-based content delivery over HTTP. The CVSS vector's requirement for human interaction (UI:R) combined with unauthenticated network access (AV:N/PR:N) is characteristic of client-side vectors such as cross-site scripting, cross-site request forgery, or a maliciously crafted link/document that executes in an authenticated victim's browser session against the Content Server web interface. No CWE was assigned by NVD or Oracle, so the precise root-cause class cannot be confirmed from the available data; the Oracle CPU advisory (cpujul2026.html) is the sole authoritative source and does not publish technical internals.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and vendor-recommended remediation for both 12.2.1.4.0 and 14.1.2.0.0; the advisory does not enumerate a separate patched build number in the provided data, so treat this as 'Patch available per vendor advisory' and reference the CPU for the exact patch identifiers for your version. Because the vector depends on user interaction against the web interface, effective compensating controls until patching include restricting network exposure of the Content Server HTTP interface to trusted internal networks or VPN, placing it behind a web application firewall to filter malicious requests, and enforcing anti-CSRF protections and strict Content-Security-Policy headers if not already active - with the trade-off that WAF rules may need tuning to avoid blocking legitimate content operations, and network restriction limits external partner/self-service access. User awareness against suspicious links pointing at the WebCenter Content host is a supplementary control given the UI:R requirement.