CVE-2026-60635 in WebCenter Content
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle WebCenter Content, a component of Oracle Fusion Middleware that provides content management capabilities for enterprise environments. The affected versions 12.2.1.4.0 and 14.1.2.0.0 represent critical security gaps in the Content Server component that can be exploited by unauthenticated attackers. The vulnerability's classification as easily exploitable indicates that attackers can leverage it without requiring specialized tools or extensive technical knowledge, making it particularly dangerous for organizations running these specific versions.
The technical flaw stems from insufficient authentication mechanisms within the HTTP interface of Oracle WebCenter Content, allowing network-based attacks to compromise the system entirely. This vulnerability operates through a combination of factors including network accessibility and the requirement for human interaction from users other than the attacker, suggesting that social engineering or user manipulation may be necessary to complete the attack vector. The CVSS 3.1 score of 8.8 reflects the high severity impact across all three security pillars - confidentiality, integrity, and availability - indicating that successful exploitation could result in complete system compromise.
The operational impact of this vulnerability extends beyond simple data theft or service disruption, as it enables full takeover of Oracle WebCenter Content systems. This means that attackers could gain administrative control over content management workflows, access sensitive documents, modify content repositories, and potentially use the compromised system as a launch point for further attacks within the organization's network infrastructure. The fact that this vulnerability requires human interaction from users other than the attacker suggests that it likely involves user-facing components such as web forms or interactive content submission interfaces that may be manipulated through social engineering tactics.
Organizations running affected versions should immediately implement mitigations including restricting network access to the Content Server, applying available patches from Oracle, and implementing additional monitoring controls around HTTP traffic. The vulnerability aligns with CWE-287 which addresses improper authentication issues in software systems, and represents a significant risk under ATT&CK framework category T1078 for Valid Accounts and T1190 for Exploit Public-Facing Application. Organizations should also consider network segmentation, firewall rules limiting access to Content Server ports, and implementing intrusion detection systems to monitor for exploitation attempts.
Mitigation strategies must include immediate patching of affected systems, implementation of network-based controls such as firewalls restricting HTTP access to trusted networks only, and enhanced monitoring of web application logs for suspicious activity. Security teams should also conduct thorough vulnerability assessments to identify other potentially affected components within their Oracle Fusion Middleware environment and implement principle of least privilege access controls. The human interaction requirement suggests that user training programs focused on recognizing social engineering attempts may be necessary alongside technical controls to provide comprehensive protection against this vulnerability class.