CVE-2026-60663 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle WebCenter Content, particularly versions 12.2.1.4.0 and 14.1.2.0.0, should be aware of this critical vulnerability and prioritize patching. The vulnerability's high CVSS score and potential for significant impact through scope change make it a priority for security teams to address.

Technical summary

The CVE-2026-60663 vulnerability affects Oracle WebCenter Content's Web Content Management component, with versions 12.2.1.4.0 and 14.1.2.0.0 being vulnerable. The vulnerability allows low-privileged attackers with network access via HTTP to compromise Oracle WebCenter Content, with a CVSS 3.1 Base Score of 9.9 indicating critical severity. Successful attacks can result in takeover of Oracle WebCenter Content and may significantly impact additional products due to scope change.

Defensive priority

Organizations using Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 should prioritize patching due to the critical CVSS score of 9.9 and potential for significant impact through scope change.

Recommended defensive actions

• Apply patches for Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 as recommended by the vendor.
• Implement compensating controls such as network segmentation and access restrictions to limit the attack surface.
• Monitor Oracle WebCenter Content instances for suspicious activity and ensure proper logging and auditing.
• Review and update inventory of Oracle WebCenter Content deployments to ensure accurate tracking and prioritization.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE description indicates a vulnerability in Oracle WebCenter Content's Web Content Management component, allowing low-privileged attackers with network access via HTTP to compromise the product. The CVSS 3.1 Base Score is 9.9, indicating critical severity. The vulnerability is easily exploitable and can result in takeover of Oracle WebCenter Content. However, details about the vendor's remediation status and affected scope beyond Oracle WebCenter Content are limited.

Official resources