CVE-2026-60933 in WebCenter Content
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Content Server component of Oracle WebCenter Content, a core part of the Oracle Fusion Middleware suite. This security flaw affects specific supported releases, namely version 12.2.1.4.0 and version 14.1.2.0.0. The nature of this defect is characterized by its difficulty to exploit, which implies that while an attack vector exists, it requires a high degree of precision or specific conditions to be successfully leveraged. Despite the complexity involved in exploitation, the vulnerability presents a significant risk because it allows for unauthorized access without any prior authentication credentials. An attacker with network connectivity to the target system can initiate this compromise via standard HTTP protocols, bypassing traditional perimeter defenses that rely on identity verification as their primary control mechanism.
From a technical perspective, the flaw enables an unauthenticated actor to manipulate critical data structures within the application. The operational impact is severe, granting the adversary unauthorized capabilities to create, delete, or modify sensitive information stored in the Content Server database and file systems. This level of access extends beyond mere data theft; it allows for the alteration of system integrity by modifying existing records or injecting malicious content that could be served to other users. Furthermore, the vulnerability facilitates complete unauthorized access to all data accessible through Oracle WebCenter Content, effectively neutralizing confidentiality controls. The attacker can read sensitive documents, configuration files, and user metadata without detection, leading to a comprehensive breach of the system's security posture.
The severity of this issue is quantified by a CVSS 3.1 Base Score of 7.4, which classifies it as High Severity. This score reflects substantial impacts on both Confidentiality and Integrity, while Availability remains unaffected according to the provided vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). The Attack Vector is Network, indicating remote exploitability over TCP/IP networks without physical access. Although the Attack Complexity is High, suggesting that specialized conditions are needed for successful exploitation, the Privileges Required and User Interaction fields are both None, meaning no valid user account or social engineering tactics are necessary to trigger the flaw. This combination makes it a persistent threat to organizations relying on these specific versions of WebCenter Content for document management and collaboration services.
In terms of industry classification standards, this vulnerability aligns with CWE-287, which describes Improper Authentication, as well as potential mappings to CWE-352 (Cross-Site Request Forgery) or CWE-918 if the flaw involves server-side request forgery mechanisms often found in middleware components. From a tactical perspective within the MITRE ATT&CK framework, this vulnerability supports techniques associated with Initial Access and potentially Persistence if the attacker modifies system configurations to maintain access. The ability to modify critical data also touches upon Defense Evasion by allowing an adversary to alter logs or security settings to hide their presence after exploitation.
To mitigate this risk, organizations running affected versions of Oracle WebCenter Content must apply the latest available patches provided by Oracle as part of their Critical Patch Update cycle. Immediate remediation is recommended given the remote and unauthenticated nature of the exploit. In addition to patching, it is advisable to implement network-level controls such as web application firewalls that can detect anomalous HTTP requests indicative of exploitation attempts for this specific vulnerability class. Restricting direct internet-facing access to WebCenter Content instances by placing them behind a secure gateway or VPN further reduces the attack surface. Regular security assessments and penetration testing should be conducted to verify that the patch has been correctly applied and that no residual configurations allow unauthenticated data manipulation.