Description
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
Published: 2026-07-21
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an unauthorized access flaw in Oracle WebCenter Content that permits unauthenticated actors who can reach the application over HTTP to create, delete, or modify data, jeopardizing both confidentiality and integrity of the content. The weakness is an improper access control flaw identified as CWE-284 and can potentially impact related components due to a scope change.

Affected Systems

Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0, part of Oracle Fusion Middleware. Any installation of these versions that is reachable over HTTP is vulnerable.

Risk and Exploitability

The CVSS 3.1 Base Score of 8.7 indicates high severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely in the wild, but the vulnerability can be exercised remotely without authentication or special conditions, and is not listed in the CISA KEV catalog. Attackers can compromise data confidentiality and integrity, and due to the scope change, adjacent components may also be affected.

Generated by OpenCVE AI on August 4, 2026 at 03:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the July 2026 Oracle WebCenter Content patch that addresses the unauthorized access flaw.
  • Restrict HTTP/HTTPS traffic to trusted IP ranges or enforce network segmentation to limit exposure.
  • Enforce strict authentication, use least‑privilege roles, and enable application‑level access controls to limit the potential damage if an attacker gains access.

Generated by OpenCVE AI on August 4, 2026 at 03:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 04:15:00 +0000

Type Values Removed Values Added
Title Oracle WebCenter Content - Unauthorized Data Modification via HTTP Access

Thu, 30 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Title Oracle WebCenter Content - Unauthorized Data Modification via HTTP Access

Tue, 28 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated data modification in Oracle WebCenter Content

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 24 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated data modification in Oracle WebCenter Content
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
First Time appeared Oracle
Oracle webcenter Content
CPEs cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_content:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Content
References
Metrics cvssV3_1

{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Oracle Webcenter Content
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-28T03:56:05.809Z

Reserved: 2026-07-08T15:51:40.537Z

Link: CVE-2026-60448

cve-icon Vulnrichment

Updated: 2026-07-24T15:13:34.769Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T04:00:03Z

Weaknesses