CVE-2026-60640 in WebCenter Content
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle WebCenter Content, a component of Oracle Fusion Middleware that serves as a content management platform for enterprise organizations. The affected versions 12.2.1.4.0 and 14.1.2.0.0 represent critical security gaps that enable unauthenticated remote attackers to compromise the system through HTTP network connections. The CVSS base score of 8.3 indicates a high-severity threat with significant impacts across confidentiality, integrity, and availability domains. This vulnerability demonstrates characteristics consistent with CWE-284 (Improper Access Control) and aligns with ATT&CK techniques involving privilege escalation and persistence mechanisms.
The technical exploitation requires network-level access via HTTP protocols, making it particularly concerning for organizations with exposed web services. While the vulnerability is classified as difficult to exploit, it necessitates human interaction from users other than the attacker, suggesting potential social engineering components or targeted user engagement scenarios. The CVSS vector analysis reveals that attack complexity is high (AC:H) yet no authentication is required (PR:N), indicating that attackers can leverage this flaw without prior credentials. The scope change aspect (S:C) is particularly significant as it suggests that successful exploitation could extend beyond the immediate WebCenter Content system to impact additional Oracle products within the enterprise environment.
The operational impact of this vulnerability extends far beyond simple data compromise, as successful exploitation can result in complete takeover of the Oracle WebCenter Content system. This level of control enables attackers to manipulate content repositories, potentially gaining access to sensitive business information, intellectual property, and confidential documents stored within the platform. The confidentiality, integrity, and availability impacts are all rated as high (C:H/I:H/A:H), indicating that attackers could not only read protected content but also modify or delete critical data while potentially disrupting system operations entirely.
Organizations should implement immediate mitigations including network segmentation to restrict access to WebCenter Content services, applying available Oracle patches and updates, and implementing robust monitoring solutions to detect anomalous HTTP traffic patterns. The vulnerability's classification under ATT&CK framework suggests potential lateral movement capabilities once initial compromise occurs, making comprehensive network security measures essential. Additionally, organizations should conduct thorough risk assessments to identify all systems potentially impacted by scope change effects and implement multi-factor authentication controls where possible. Regular security audits and vulnerability scanning should be enhanced to detect similar access control weaknesses across the Oracle Fusion Middleware stack.