Description
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability stems from insufficient input validation (CWE‑20) and insecure handling of cross‑site request forgery (CWE‑352), open redirects (CWE‑601), and cross‑site scripting (CWE‑79) within Oracle WebCenter Content’s Content Server component. An attacker who is able to send unauthenticated HTTP requests to the server can ultimately trigger a takeover, but the successful exploitation requires human interaction to complete the attack sequence. The impact is a full compromise of confidentiality, integrity, and availability for the affected instance.

Affected Systems

Oracle WebCenter Content products, specifically versions 12.2.1.4.0 and 14.1.2.0.0, are affected by this vulnerability.

Risk and Exploitability

The CVSS 3.1 score of 8.8 indicates a high severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is invoked via network‑based HTTP requests to the vulnerable component, and the exploit path requires the presence of an interactive human to complete the takeover after initial access.

Generated by OpenCVE AI on August 4, 2026 at 03:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle WebCenter Content patch released in the CPU July 2026 update for both 12.2.1.4.0 and 14.1.2.0.0.
  • Enforce strict input validation on all HTTP parameters to reject malformed or malicious inputs (CWE‑20).
  • Add anti‑CSRF tokens to state‑changing requests to address cross‑site request forgery (CWE‑352).
  • Validate and whitelist outbound redirects to close open redirect issues (CWE‑601) and sanitize all user‑supplied content to avoid cross‑site scripting (CWE‑79).
  • Restrict external access to WebCenter Content HTTP endpoints using firewall or VPN to limit connectivity to trusted IP ranges.

Generated by OpenCVE AI on August 4, 2026 at 03:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 03:45:00 +0000

Type Values Removed Values Added
Title Remote Takeover of Oracle WebCenter Content via Unauthenticated HTTP Access

Sat, 01 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Title Remote Takeover of Oracle WebCenter Content via Unauthenticated HTTP Access

Thu, 30 Jul 2026 14:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Takeover via HTTP in Oracle WebCenter Content
Weaknesses CWE-200
CWE-284

Mon, 27 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-352
CWE-601
CWE-79
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Takeover via HTTP in Oracle WebCenter Content
Weaknesses CWE-200
CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle webcenter Content
CPEs cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_content:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Content
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Webcenter Content
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-28T03:56:30.268Z

Reserved: 2026-07-08T15:51:40.549Z

Link: CVE-2026-60639

cve-icon Vulnrichment

Updated: 2026-07-27T12:54:25.311Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T03:30:03Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-352

    Cross-Site Request Forgery (CSRF)

  • CWE-601

    URL Redirection to Untrusted Site ('Open Redirect')

  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')