CVE-2026-60643 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 should prioritize patching this vulnerability. Low-privileged attackers with network access via HTTP can exploit this vulnerability, which requires human interaction to succeed.

Technical summary

The vulnerability in Oracle WebCenter Content's Content Server component allows for easy exploitation by low-privileged attackers with network access via HTTP. The attack requires human interaction from a person other than the attacker. Successful exploitation can lead to a complete takeover of Oracle WebCenter Content. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, with a Base Score of 8.0.

Defensive priority

High priority should be given to patching this vulnerability due to its high CVSS score of 8.0 and the potential for a low-privileged attacker to compromise the system.

Recommended defensive actions

• Apply the patches provided by Oracle for Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0.
• Restrict network access to the Oracle WebCenter Content system to only trusted users.
• Monitor for any suspicious activity that could indicate exploitation attempts.
• Implement additional security measures such as multi-factor authentication for users interacting with the system.
• Review system logs for signs of potential exploitation.
• Conduct regular security audits to ensure compliance with security policies.
• Verify that all users have the least privileges necessary to perform their tasks.

Evidence notes

The CVE record was published on 2026-07-21T22:18:05.083Z and was last modified on 2026-07-27T14:16:58.063Z. The NVD entry is currently undergoing analysis. Oracle has provided a security alert for this vulnerability.

Official resources