CVE-2026-60635 Oracle Corporation CVE debrief

Who should care

Administrators and users of Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes reviewing system configurations, ensuring proper patching, and monitoring for suspicious activity. Additionally, security teams and vulnerability management teams should prioritize patching or mitigating this vulnerability due to its high CVSS score and the potential for system takeover.

Technical summary

The vulnerability in Oracle WebCenter Content allows an unauthenticated attacker with network access via HTTP to compromise the system. The attack requires human interaction from another person. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, with a Base Score of 8.8, indicating high severity. This vulnerability affects Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0, and successful attacks can result in the takeover of Oracle WebCenter Content. It is essential to apply patches or implement compensating controls to mitigate this vulnerability.

Defensive priority

High priority should be given to patching or mitigating this vulnerability due to its high CVSS score and the potential for system takeover.

Recommended defensive actions

• Apply the patches provided by Oracle as soon as possible.
• Implement compensating controls such as Web Application Firewalls (WAFs) to detect and prevent exploitation attempts.
• Monitor systems for suspicious activity.
• Ensure human interaction is scrutinized to prevent social engineering attacks.
• Inventory and verify the versions of Oracle WebCenter Content in use.

Evidence notes

The CVE record was published on 2026-07-21T22:18:04.190Z and was last modified on 2026-07-27T14:16:56.937Z. The NVD entry is currently Undergoing Analysis. The vulnerability details are based on the information provided by the CVE.org and NVD.

Official resources