CVE-2026-60638: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. in Oracle Corporation Oracle WebCenter Content
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
AI Analysis
Technical Summary
This vulnerability affects Oracle WebCenter Content in versions 12.2.1.4.0 and 14.1.2.0.0. It permits an unauthenticated attacker with network access over HTTP to exploit the system, contingent on human interaction from a third party. The attack can result in complete compromise of the Oracle WebCenter Content environment. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is associated with multiple CWEs including CWE-601 (URL Redirection), CWE-79 (Cross-site Scripting), CWE-352 (Cross-Site Request Forgery), and CWE-20 (Input Validation). The vendor advisory from Oracle does not explicitly confirm patch availability or remediation level for this specific vulnerability but references a Critical Patch Update released in July 2026 that includes numerous security fixes. No known exploits in the wild have been reported.
Potential Impact
Successful exploitation can lead to full takeover of Oracle WebCenter Content, impacting confidentiality, integrity, and availability of the system. The vulnerability allows unauthenticated remote attackers to compromise the product via HTTP, requiring user interaction from a third party. This can result in unauthorized access, data disclosure, modification, or denial of service within the affected Oracle WebCenter Content environment.
Mitigation Recommendations
Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities across its product portfolio. Although the vendor advisory does not explicitly confirm a patch for CVE-2026-60638, it strongly recommends applying all available security patches promptly. Users of Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 should review the July 2026 Critical Patch Update advisory and apply relevant patches without delay. Patch status is not yet confirmed specifically for this vulnerability — check the vendor advisory for current remediation guidance.
CVE-2026-60638: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. in Oracle Corporation Oracle WebCenter Content
Description
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS v3.1
Score 8.8high
Affected software
pkg:maven/com.oracle.webcenter/contentRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Oracle WebCenter Content in versions 12.2.1.4.0 and 14.1.2.0.0. It permits an unauthenticated attacker with network access over HTTP to exploit the system, contingent on human interaction from a third party. The attack can result in complete compromise of the Oracle WebCenter Content environment. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is associated with multiple CWEs including CWE-601 (URL Redirection), CWE-79 (Cross-site Scripting), CWE-352 (Cross-Site Request Forgery), and CWE-20 (Input Validation). The vendor advisory from Oracle does not explicitly confirm patch availability or remediation level for this specific vulnerability but references a Critical Patch Update released in July 2026 that includes numerous security fixes. No known exploits in the wild have been reported.
Potential Impact
Successful exploitation can lead to full takeover of Oracle WebCenter Content, impacting confidentiality, integrity, and availability of the system. The vulnerability allows unauthenticated remote attackers to compromise the product via HTTP, requiring user interaction from a third party. This can result in unauthorized access, data disclosure, modification, or denial of service within the affected Oracle WebCenter Content environment.
Mitigation Recommendations
Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities across its product portfolio. Although the vendor advisory does not explicitly confirm a patch for CVE-2026-60638, it strongly recommends applying all available security patches promptly. Users of Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 should review the July 2026 Critical Patch Update advisory and apply relevant patches without delay. Patch status is not yet confirmed specifically for this vulnerability — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:40.549Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fee009c2644c7f8d5b075
Added to database: 07/21/2026, 22:09:04 UTC
Last enriched: 07/30/2026, 00:24:45 UTC
Last updated: 09/02/2026, 22:52:13 UTC
Views: 54
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.