PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60467 Oracle CVE debrief

A high-severity vulnerability was discovered in Oracle Fusion Middleware's WebCenter Content: Imaging product, specifically in the Core component. The vulnerability, tracked as CVE-2026-60467, has a CVSS score of 7.5 and allows unauthenticated attackers with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and can result in takeover of the system. This vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0 of the product.

Vendor
Oracle
Product
Fusion Middleware WebCenter Content: Imaging
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-25
Advisory published
2026-07-21
Advisory updated
2026-07-25

Who should care

Organizations using Oracle Fusion Middleware's WebCenter Content: Imaging product, specifically versions 12.2.1.4.0 and 14.1.2.0.0, should prioritize patching this vulnerability. Security teams and vulnerability management teams should review the affected scope and implement necessary mitigations.

Technical summary

The vulnerability is located in the Core component of WebCenter Content: Imaging and is difficult to exploit. Successful attacks require human interaction from a person other than the attacker and can result in takeover of the system. The CVSS vector for this vulnerability is (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). This vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0 of the product. Organizations should verify their deployments and apply patches as recommended by Oracle. Security teams should review system configurations, implement necessary mitigations, and monitor for potential attacks. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified.

Defensive priority

High priority should be given to patching this vulnerability due to its high CVSS score and potential impact on system security.

Recommended defensive actions

  • Apply the patch provided by Oracle as soon as possible
  • Conduct a thorough review of system configurations and network access controls
  • Implement additional security measures to prevent unauthorized access
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-21T22:17:49.190Z and last modified on 2026-07-25T05:16:38.697Z. The NVD entry is currently Undergoing Analysis. This information is based on the NVD entry and the CVE record. Further verification is recommended to confirm affected scope and severity.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:17:49.190Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.