CVE-2026-60647 in WebCenter Content
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Content. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle WebCenter Content, a component of Oracle Fusion Middleware that manages web content and document management capabilities. The flaw affects specifically versions 12.2.1.4.0 and 14.1.2.0.0, representing a significant security risk for organizations utilizing these middleware platforms. The vulnerability's exploitability classification as easily exploitable indicates that attackers with minimal technical skills can leverage this weakness, making it particularly dangerous in production environments where such systems handle sensitive corporate data and critical business processes.
The technical nature of this flaw allows a low privileged attacker to gain unauthorized access through HTTP network connections, bypassing normal authentication mechanisms. This represents a privilege escalation vulnerability where an attacker with minimal credentials can potentially access all content managed by Oracle WebCenter Content, including confidential documents, user information, and system metadata. The CVSS 3.1 score of 7.1 reflects the severity level, with high confidentiality impact indicating potential exposure of critical data and low availability impact suggesting partial denial of service capabilities. The vulnerability's attack vector AV:N (network access) combined with AC:L (low complexity) and PR:L (low privilege requirements) creates a dangerous combination that can be exploited by attackers from external networks without requiring significant technical expertise.
The operational impact extends beyond simple data compromise, as successful exploitation can result in complete access to all accessible Oracle WebCenter Content data, potentially exposing intellectual property, customer information, and sensitive business documents. Organizations using this software may face regulatory compliance violations and significant financial losses due to data breaches. The partial denial of service component adds another layer of risk, where attackers could disrupt business operations by making content management services unavailable to legitimate users. This vulnerability affects the fundamental security posture of Oracle Fusion Middleware implementations and represents a critical gap in access controls that can be leveraged by threat actors.
Mitigation strategies should prioritize immediate patching of affected versions to address the core vulnerability. Organizations should implement network segmentation to limit access to Oracle WebCenter Content systems, enforce strict authentication mechanisms, and deploy intrusion detection systems to monitor for exploitation attempts. Regular security assessments and vulnerability scanning should be conducted to identify similar weaknesses in related components. The vulnerability aligns with CWE-284 (Improper Access Control) and may map to ATT&CK techniques involving credential access and privilege escalation. Organizations should also review their incident response procedures to ensure rapid detection and remediation of such vulnerabilities, as the low privilege requirements make this flaw particularly attractive to adversaries seeking persistent access to enterprise content management systems.