CVE-2026-60469 in WebCenter Content Imaging
Summary
by MITRE • 07/22/2026
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebCenter Content: Imaging. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in WebCenter Content: Imaging, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all WebCenter Content: Imaging accessible data as well as unauthorized access to critical data or complete access to all WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Fusion Middleware's WebCenter Content: Imaging component, specifically in the core functionality of the application. The affected versions 12.2.1.4.0 and 14.1.2.0.0 represent critical security gaps that enable attackers to compromise the imaging platform through network-based HTTP connections. The vulnerability's classification as easily exploitable indicates that minimal technical expertise is required for successful exploitation, making it particularly dangerous in production environments where default configurations may not adequately protect against such threats.
The technical flaw manifests as a privilege escalation vulnerability that requires low privileged attacker credentials but can be leveraged through network access via HTTP protocols. This creates a significant risk vector where malicious actors can exploit the system's authentication and authorization mechanisms to gain unauthorized access to imaging data. The vulnerability's scope extends beyond the immediate WebCenter Content: Imaging product, as indicated by the scope change aspect of the attack, potentially affecting additional Oracle Fusion Middleware products that may share common infrastructure or data repositories.
The operational impact of this vulnerability is severe and multifaceted, encompassing complete data compromise scenarios that allow unauthorized modification, deletion, and creation access to all imaging data accessible through the platform. The CVSS 3.1 Base Score of 8.7 reflects the high severity of both confidentiality and integrity impacts, with the vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N indicating network-based exploitation requiring low access privileges but necessitating user interaction from individuals other than the attacker. This requirement for human interaction suggests that social engineering or phishing techniques may be employed to facilitate initial access before leveraging the vulnerability.
The attack requires a victim to perform specific actions such as clicking malicious links or opening compromised files, which aligns with common attack patterns described in the MITRE ATT&CK framework under privilege escalation and initial access techniques. This human interaction component increases the practical exploitability of the vulnerability in real-world scenarios where user behavior cannot be completely controlled. The potential for scope change means that successful exploitation could extend beyond imaging data to impact related systems, potentially creating cascading security failures within the Oracle Fusion Middleware environment.
Organizations must implement immediate mitigation strategies including network segmentation, enhanced monitoring of HTTP traffic, and comprehensive access control reviews. The vulnerability's characteristics align with CWE-284 (Improper Access Control) and CWE-352 (Cross-Site Request Forgery) categories, emphasizing the need for robust authentication mechanisms and input validation controls. Patch management should be prioritized immediately, as Oracle typically provides security patches for such vulnerabilities in their regular update cycles, though organizations may also implement temporary network-level restrictions to limit exposure while permanent fixes are deployed.