What is the CVSS score of EUVD-2026-47019?

EUVD-2026-47019 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by EUVD-2026-47019?

Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) can be fully compromised through manipulated user interactions, potentially exposing critical business documents and enabling…

How to fix or mitigate EUVD-2026-47019?

Within 24 hours, identify all systems running Oracle WebCenter Content versions 12.2.1.4.0 or 14.1.2.0.0 and issue security alerts to users on recognizing social engineering attempts targeting content access. Within 7 days, implement network-level access controls restricting WebCenter Content to internal users only, enable multi-factor authentication at the application level if supported, and document content recovery procedures for compromise scenarios. Within 30 days, establish vendor advisory monitoring for Oracle WebCenter Content patches (none identified at time of analysis), plan upgrade strategy to patched versions once available, and deploy targeted security awareness training for content administrators and frequent users.

Oracle WebCenter Content EUVD-2026-47019

| CVE-2026-60658 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-21 secalert_us@oracle.com

GHSA-5vxv-fjfc-cxrw

CSRF Oracle Webcenter Content

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network HTTP-reachable and unauthenticated (AV:N/PR:N) but requires victim interaction and difficult conditions (UI:R/AC:H); full takeover gives C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:59 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover of Oracle WebCenter Content (Content Server component) in versions 12.2.1.4.0 and 14.1.2.0.0 can be achieved by an unauthenticated remote attacker over HTTP, but only by luring a separate user into an interaction that triggers the flaw. Rated CVSS 3.1 7.5 with high confidentiality, integrity, and availability impact, the issue is classified 'difficult to exploit' due to high attack complexity and the required human interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the practical risk is gated by the social-engineering step despite the severe potential impact.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management (ECM) platform within Oracle Fusion Middleware, used for document/records management, imaging, and digital asset management; the affected element is the Content Server, its core HTTP-facing service that stores, indexes, and serves managed content. The vulnerability lives in the request-handling path reachable over HTTP, and Oracle's phrasing that 'successful attacks require human interaction from a person other than the attacker' plus the mixed 'Information Disclosure' tag point to a client-facing vector (for example a crafted link/response that a victim user must open) rather than a purely server-autonomous flaw. Oracle does not publish a CWE for this entry (CWE: N/A), so the precise root-cause class is not disclosed; the UI:R + full C/I/A takeover profile is consistent with vulnerability classes such as cross-site scripting, request forgery, or crafted-content parsing that leverage an authenticated victim's session/context to reach full compromise.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor advisory covering CVE-2026-60658 for both 12.2.1.4.0 and 14.1.2.0.0; the CPU delivers cumulative patches for these branches, so install the corresponding WebCenter Content bundle patch for your version. Because a distinct fix version string is not present in the provided data, treat 'Patch available per vendor advisory' as the patch status and pull the exact patch number from the CPU matrix during scheduling. As compensating controls until patched: restrict network reachability of the Content Server HTTP endpoints to trusted networks or place them behind a VPN/reverse proxy with authentication, since the exploit is delivered over HTTP and requires a victim to interact - reducing exposure of the UI to untrusted users directly lowers the attack surface (trade-off: may block legitimate external content access). Reinforce user-side defenses against malicious links/content (email/link filtering, browser hardening) given the UI:R requirement, and monitor Content Server access logs for anomalous requests; these controls reduce likelihood but do not remove the underlying flaw, so patching remains the durable fix.