PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60472 Oracle Corporation CVE debrief

A high-severity vulnerability was discovered in Oracle Fusion Middleware's WebCenter Content: Imaging product, specifically in the Core component. The vulnerability is easily exploitable, allowing a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in a takeover of WebCenter Content: Imaging. This vulnerability has significant implications for administrators and security teams responsible for Oracle Fusion Middleware and WebCenter Content: Imaging, as it can lead to potential system takeovers if not properly addressed.

Vendor
Oracle Corporation
Product
WebCenter Content: Imaging
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-28
Advisory published
2026-07-21
Advisory updated
2026-07-28

Who should care

Administrators and security teams responsible for Oracle Fusion Middleware and WebCenter Content: Imaging should prioritize patching this vulnerability to prevent potential takeovers. They should review the vulnerability's impact on their specific deployments, assess their current security controls, and take immediate action to mitigate exposure.

Technical summary

The vulnerability, CVE-2026-60472, has a CVSS 3.1 Base Score of 8.8, indicating high impacts on confidentiality, integrity, and availability. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Affected versions include 12.2.1.4.0 and 14.1.2.0.0. This high-severity vulnerability in Oracle Fusion Middleware's WebCenter Content: Imaging product, specifically in the Core component, is easily exploitable by a low-privileged attacker with network access via HTTP, potentially leading to a system takeover.

Defensive priority

High priority due to the high CVSS score and potential for system takeover.

Recommended defensive actions

  • Apply the patch from Oracle as soon as possible
  • Review and update network access controls to limit exposure
  • Monitor systems for suspicious activity
  • Consider compensating controls if patching is not immediately feasible
  • Review relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-21T22:17:49.760Z and last modified on 2026-07-25T05:16:39.310Z. The NVD entry is currently Undergoing Analysis. Oracle has provided a security alert for this vulnerability. The information provided is based on the CVE record and NVD entry, which may have limited details. Further verification and analysis are recommended to fully understand the vulnerability's impact and affected scope.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-60472 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-60472

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-60472 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-60472

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.