CVE-2026-60639 in WebCenter Content
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle WebCenter Content, specifically in the Content Server component of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw represents a critical security weakness that enables unauthenticated attackers to compromise the target system through HTTP network connections. The vulnerability's exploitability is classified as easily accessible, meaning minimal technical expertise is required for successful exploitation, making it particularly dangerous in production environments where such systems may be exposed to external networks.
The technical nature of this vulnerability involves an authentication bypass mechanism that allows attackers to gain unauthorized access to the Content Server functionality without proper credentials. The CVSS 3.1 scoring system rates this vulnerability at 8.8 out of 10, indicating a high severity threat level with significant impacts across all three core security principles. The attack vector AV:N indicates network-based exploitation, while AC:L shows low complexity requirements for successful compromise. The PR:N classification confirms there are no privileges required for the initial attack, and UI:R suggests that some form of user interaction is necessary for complete exploitation, though this interaction does not require active participation from the attacker.
The operational impact of this vulnerability is severe and potentially catastrophic for organizations relying on Oracle WebCenter Content for document management and content services. Successful exploitation can result in full system takeover, allowing attackers to execute arbitrary code, modify or delete critical content, access sensitive data repositories, and potentially use the compromised system as a launchpad for further attacks within the network infrastructure. This represents a complete loss of confidentiality, integrity, and availability as indicated by the CVSS scoring vector components.
Organizations should implement immediate mitigations including network segmentation to restrict access to Oracle WebCenter Content servers, deployment of web application firewalls to monitor and filter HTTP traffic, and implementation of strict access controls limiting who can interact with the content server. The vulnerability aligns with CWE-287 (Improper Authentication) and potentially CWE-312 (Cleartext Storage of Sensitive Information) depending on the specific implementation details. From an ATT&CK framework perspective, this vulnerability maps to T1190 (Exploit Public-Facing Application) and T1071.004 (Application Layer Protocol: DNS), as attackers may use the compromised system for further reconnaissance or lateral movement activities. Organizations should also consider implementing regular security assessments and penetration testing to identify similar weaknesses in their Oracle Fusion Middleware environments, particularly focusing on authentication mechanisms and access controls that could be similarly compromised.