CVE-2026-60633 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 should be aware of this vulnerability and take necessary actions to protect their systems, including reviewing system deployments, validating affected scope, and planning vendor-supported updates or mitigations through normal change control.

Technical summary

The vulnerability in Oracle WebCenter Content allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction and can lead to a takeover of the system. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, with a base score of 8.8. Affected product deployments should be reviewed for exposure, and compensating controls should be implemented for exposed systems while remediation is scheduled and verified.

Defensive priority

High

Recommended defensive actions

• Apply the vendor's official patch or update to a non-vulnerable version.
• Implement compensating controls, such as monitoring and exception tracking.
• Conduct inventory checks to identify and update vulnerable systems.
• Restrict network access to the Oracle WebCenter Content system.
• Monitor for suspicious activity and implement additional security measures as needed.

Evidence notes

The CVE record was published on 2026-07-21T22:18:03.967Z and last modified on 2026-07-27T14:16:56.660Z. The NVD entry is currently Undergoing Analysis. The vulnerability has a CVSS score of 8.8 and is considered high severity.

Official resources