CVE-2026-60448: High severity Oracle Oracle WebCenter Content vulnerability

Published Jul 21, 2026

Updated

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).

Affected Software

3 affected components

Oracle Oracle WebCenter Content=12.2.1.4.0, =14.1.2.0.0

Oracle WebCenter Content=12.2.1.4.0

Oracle WebCenter Content=14.1.2.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Oracle WebCenter Content (Oracle Fusion Middleware) - Content Server to a version that resolves this vulnerability.
Fixed in 12.2.1.4.0
Upgrade
Upgrade Oracle WebCenter Content (Oracle Fusion Middleware) - Content Server to a version that resolves this vulnerability.
Fixed in 14.1.2.0.0

Event History

Jul 21, 2026

CVE Published

via MITRE·09:35 PM

Data Sourced

via MITRE·09:35 PM

DescriptionSeverity

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-60448?

CVE-2026-60448 has a high severity rating of 8.7.

How do I fix CVE-2026-60448?

To address CVE-2026-60448, you should apply the latest security patches from Oracle for affected versions.

What products are affected by CVE-2026-60448?

CVE-2026-60448 affects Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0.

Can an unauthorized user exploit CVE-2026-60448?

Yes, CVE-2026-60448 can be exploited by an unauthenticated attacker with network access via HTTP.

What impact does CVE-2026-60448 have on affected systems?

CVE-2026-60448 allows an attacker to compromise Oracle WebCenter Content, leading to potential unauthorized access to content and information.