CVE-2026-60452 in WebCenter Content
Summary
by MITRE • 07/22/2026
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebCenter Content: Imaging. While the vulnerability is in WebCenter Content: Imaging, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all WebCenter Content: Imaging accessible data as well as unauthorized update, insert or delete access to some of WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Fusion Middleware's WebCenter Content: Imaging component, specifically in version 12.2.1.4.0 and 14.1.2.0.0, representing a significant security weakness that exploits the imaging product's core functionality. The flaw operates through HTTP network access and requires only low privilege credentials to exploit, making it particularly dangerous for organizations with less stringent access controls. According to CVSS 3.1 scoring, this vulnerability carries an 8.5 score indicating high severity with confidentiality and integrity impacts. The vector analysis shows network-based attack accessibility with low attack complexity and low privileges required, while the scope change aspect indicates that exploitation could potentially affect additional products beyond the primary imaging component.
The technical implementation of this vulnerability stems from insufficient access controls or authentication mechanisms within the imaging product's web interface, allowing malicious actors to bypass normal security boundaries. Attackers can leverage this weakness to gain unauthorized access to sensitive data stored within the imaging system and potentially modify or delete content that should remain protected. The CVSS score reflects the potential for unauthorized access to critical data, which aligns with CWE-285 (Improper Authorization) and CWE-306 (Missing Authentication for Critical Function) categories from the Common Weakness Enumeration catalog. This vulnerability essentially provides a pathway for attackers to compromise the entire imaging repository's integrity and confidentiality.
The operational impact extends beyond traditional boundaries of the imaging product, as demonstrated by the scope change element in the CVSS vector. This characteristic indicates that successful exploitation could lead to cascading effects affecting related systems or components within the Oracle Fusion Middleware ecosystem. Organizations utilizing this software may face significant data breaches where unauthorized individuals gain access to sensitive documents, images, or metadata stored within the imaging repository. The potential for complete access to all accessible data combined with unauthorized update, insert, or delete operations creates a scenario where both data confidentiality and integrity are severely compromised, as reflected in the high confidentiality impact rating of 0.8.
Mitigation strategies should focus on immediate patch deployment for affected versions, implementing network segmentation to limit access points to the imaging service, and strengthening authentication mechanisms through additional security controls. Organizations must also conduct comprehensive vulnerability assessments across their entire Oracle Fusion Middleware environment to identify potential scope expansion impacts. The ATT&CK framework categorizes this type of vulnerability under Privilege Escalation and Credential Access tactics, where attackers leverage weak authentication or authorization controls to gain elevated access rights. Network monitoring should be enhanced to detect unusual access patterns, particularly those involving HTTP requests to imaging service endpoints, while privileged account monitoring becomes critical given the low privilege attack vector. Regular security audits and access control reviews are essential to prevent unauthorized exploitation of this vulnerability across the broader Oracle Fusion Middleware infrastructure.