Description
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
Published: 2026-07-21
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Content Server component of Oracle WebCenter Content allows a low‑privileged attacker who can reach the system via HTTP to create, delete, or modify critical data. The vulnerability also permits the attacker to read all data exposed by the application, resulting in confidentiality and integrity loss. The flaw is a scope‑changing weakness that can affect other products sharing the same data store.

Affected Systems

Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 are affected. The issue resides in the Content Server sub‑component of Oracle Fusion Middleware.

Risk and Exploitability

The CVSS 3.1 base score is 8.2 with network access (AV:N), high attack complexity (AC:H), low privileges (PR:L), no user interaction (UI:N), and a scope change (S:C). The EPSS score is less than 1 %, indicating a low probability of exploitation. Oracle has released a CPU for the affected versions as indicated in the official advisory. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on August 2, 2026 at 22:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle CPU July 2026 patch to WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 as outlined in Oracle’s advisory
  • Restrict external HTTP access to WebCenter Content to trusted IP ranges or VPN and use a Web Application Firewall to block anomalous requests
  • Re‑evaluate and tighten role permissions, disabling any unused authentication mechanisms

Generated by OpenCVE AI on August 2, 2026 at 22:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege Remote Data Manipulation in Oracle WebCenter Content

Thu, 30 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Title Low‑Privileged Network Attack Enables Unauthorized Access in Oracle WebCenter Content

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 24 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
Title Low‑Privileged Network Attack Enables Unauthorized Access in Oracle WebCenter Content
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
First Time appeared Oracle
Oracle webcenter Content
CPEs cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_content:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Content
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Oracle Webcenter Content
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-28T03:56:12.910Z

Reserved: 2026-07-08T15:51:40.542Z

Link: CVE-2026-60525

cve-icon Vulnrichment

Updated: 2026-07-24T15:38:53.496Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T22:15:03Z

Weaknesses