CVE-2026-60955 in WebCenter Content
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized read access to a subset of Oracle WebCenter Content accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Content. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Content Server component of Oracle WebCenter Content, a critical enterprise content management solution integrated into the Oracle Fusion Middleware suite. This security flaw affects specific supported releases, namely version 12.2.1.4.0 and version 14.1.2.0.0. The nature of this vulnerability is particularly concerning due to its high exploitability characteristics; it requires only low attack complexity and no user interaction, allowing for straightforward exploitation by an attacker who has already established network access via the HTTP protocol. However, a significant prerequisite for successful exploitation is that the attacker must possess high-privileged credentials within the Oracle WebCenter Content environment. This requirement suggests that while the technical flaw itself may be easily triggered once authenticated, it represents a severe risk in environments where privilege escalation or credential theft has already occurred, effectively serving as an amplifier for existing insider threats or compromised administrative accounts.
The operational impact of this vulnerability extends beyond the immediate boundaries of Oracle WebCenter Content due to its potential scope change. While the technical flaw is localized within the Content Server component, successful exploitation can lead to cascading failures that significantly impact additional products connected to or dependent on the middleware infrastructure. This lateral movement capability underscores the interconnected nature of modern enterprise application stacks and highlights how a compromise in one module can destabilize broader organizational IT operations. The specific consequences of a successful attack are severe, encompassing unauthorized creation, deletion, or modification of critical data as well as all accessible data within Oracle WebCenter Content. Furthermore, attackers gain the ability to perform unauthorized read access on subsets of this data and execute actions that result in a partial denial of service condition. This combination of integrity loss, confidentiality breach, and availability disruption aligns with high-severity security incidents that can lead to significant regulatory non-compliance, financial loss, and reputational damage for affected organizations.
From a technical classification perspective, the vulnerability exhibits characteristics consistent with CWE-269 Improper Privilege Management or potentially CWE-787 Out-of-bounds Write if the modification capabilities stem from memory corruption, though the description emphasizes access control failures leading to data manipulation. The attack vector aligns with MITRE ATT&CK techniques such as T1078 Valid Accounts for initial foothold maintenance and subsequent actions like T1485 Data Destruction or T1486 Data Encrypted for Impact if ransomware is deployed, although the primary described impacts are unauthorized modification and denial of service. The CVSS 3.1 base score of 8.2 reflects these substantial impacts on confidentiality, integrity, and availability. The vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L) indicates that while the attack is network-based with low complexity, the high privilege requirement acts as a partial mitigator for initial access, yet the scope change to other products and the high integrity impact elevate the overall risk profile significantly.
To mitigate this vulnerability, organizations must prioritize immediate patching of Oracle WebCenter Content instances running version 12.2.1.4.0 or 14.1.2.0.0 by applying the latest security patches provided by Oracle. Given that high-privileged access is a prerequisite for exploitation, rigorous identity and access management practices are essential. This includes implementing strict least-privilege principles to ensure that administrative accounts are not routinely used for standard operations, thereby reducing the attack surface available to potential insiders or attackers who have compromised lower-level credentials through other means. Additionally, network segmentation strategies should be employed to restrict HTTP access to Content Server components from untrusted networks and limit exposure to only authorized management interfaces. Continuous monitoring of authentication logs for anomalous high-privilege activity can also aid in early detection of exploitation attempts before significant data integrity or availability issues manifest.