CVE-2026-60574 in Content Manager
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Content Manager product of Oracle E-Business Suite (component: Cover Letter). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Content Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Content Manager accessible data as well as unauthorized read access to a subset of Oracle Content Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Content Manager. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Content Manager, a component of the Oracle E-Business Suite that handles document management and workflow processes. The specific flaw exists in the Cover Letter functionality, which is used to generate and manage document cover pages within the content management system. The vulnerability affects versions 12.2.3 through 12.2.15, representing a significant portion of the Oracle E-Business Suite release cycle where this particular component was deployed. The attack vector requires network access via HTTP, making it accessible to remote attackers who can potentially exploit this weakness without requiring physical access or elevated privileges initially.
The technical nature of this vulnerability stems from insufficient input validation and access control mechanisms within the Cover Letter processing module. An attacker with low privileges can manipulate HTTP requests to bypass authentication checks and gain unauthorized access to content management functions. This flaw operates at the application layer where user inputs are not properly sanitized before being processed, creating opportunities for malicious data injection that can alter system behavior. The vulnerability's classification as easily exploitable indicates that the attack requires minimal skill and resources to execute successfully, making it particularly dangerous in production environments.
The operational impact of this vulnerability extends across multiple security domains including confidentiality, integrity, and availability. Successful exploitation enables attackers to perform unauthorized updates, inserts, and deletes on sensitive content management data, potentially compromising document repositories and workflow processes. Additionally, the vulnerability allows for unauthorized read access to specific subsets of accessible data, which could include proprietary documents, confidential communications, or business-critical information stored within the Oracle Content Manager system. The partial denial of service capability further compounds the threat by potentially disrupting legitimate user access to content management services, affecting business continuity and operational efficiency.
Organizations affected by this vulnerability should implement immediate mitigations including applying the latest security patches from Oracle that address the specific Cover Letter processing flaw. Network segmentation and firewall rules should be configured to restrict HTTP access to the Content Manager component only to authorized administrative networks. Access controls must be strengthened through proper user privilege management, ensuring that least-privilege principles are enforced for all content management operations. Security monitoring should be enhanced to detect anomalous HTTP request patterns that might indicate exploitation attempts. This vulnerability aligns with CWE-20 (Improper Input Validation) and represents a critical weakness in the application's security architecture that can be leveraged through techniques described in ATT&CK framework under T1190 (Exploit Public-Facing Application) and T1071.3 (Application Layer Protocol: Web Protocols). The CVSS 3.1 score of 6.3 reflects a medium severity threat that requires immediate attention to prevent potential data compromise and service disruption in enterprise environments relying on Oracle E-Business Suite for critical business operations.