Threat Intelligence Database

A vulnerability exists in Oracle WebCenter Content (component: Content Server) versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with logon access to the infrastructure to compromise the product, potentially leading to full takeover. The CVSS 3.1 base score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released security patches addressing this and many other vulnerabilities in their September 2026 Critical Security Patch Update advisory.

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle WebCenter Content executes to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-61295 is a high-severity vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with logon access to the underlying infrastructure to compromise Oracle WebCenter Content. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle WebCenter Content. The vulnerability also has potential scope change impacts on additional Oracle products. The CVSS 3.1 base score is 7.1, indicating a significant confidentiality impact without integrity or availability impact.

CVE-2026-61291 is a high-severity vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with logon access to the infrastructure where Oracle WebCenter Content runs to compromise the product, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.8. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory but does not explicitly confirm patch availability for these specific versions in the provided advisory content.

CVE-2026-61290 is a high-severity vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to potentially take over the product. Exploitation is difficult and requires human interaction from a person other than the attacker. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.1.

CVE-2026-61288 is a high-severity vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the system, requiring user interaction from a person other than the attacker. Successful exploitation can lead to unauthorized access to critical data and unauthorized update, insert, or delete operations on some accessible data. The vulnerability has a CVSS 3.1 base score of 7.1, indicating significant confidentiality and integrity impacts.

CVE-2026-60983 is a high-severity vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low-privileged attacker with network access via HTTP to compromise the product, potentially leading to unauthorized access to critical or all accessible data within Oracle WebCenter Content. The vulnerability has a CVSS 3.1 base score of 7.7, indicating significant confidentiality impact without affecting integrity or availability. The vulnerability also has scope change implications, potentially impacting additional Oracle products. Oracle has released a Critical Security Patch Update in August 2026 addressing this and many other vulnerabilities, and strongly recommends applying patches promptly.

CVE-2026-60981 is a high-severity vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the product, requiring user interaction from a third party. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, impacting confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 8.7. Oracle has released a Critical Security Patch Update addressing this and many other vulnerabilities, and customers are strongly advised to apply these patches promptly.

CVE-2026-60980 is a high-severity vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 8.7, indicating significant confidentiality and integrity impacts. Exploitation is difficult but can affect additional Oracle products due to scope change. Oracle has published a Critical Security Patch Update addressing this and many other vulnerabilities, strongly recommending patch application.

CVE-2026-60961 is a high-severity vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running Oracle WebCenter Content to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, impacting confidentiality and integrity. The vulnerability also has a scope change, potentially affecting additional Oracle products. The CVSS 3.1 base score is 8.0, reflecting high impact on confidentiality and integrity but no impact on availability. Oracle has published a Critical Security Patch Update advisory covering this and many other vulnerabilities, recommending patching and staying on supported versions.