CVE-2026-60949
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Vulnerability in Oracle WebCenter Content (component: Content Server) versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, allows low-privileged attacker via HTTP to gain unauthorized access to critical data and modify some data, with potential impact on other products.
Risk Assessment
Risk of unauthorized access to critical data and their modification, potentially compromising data confidentiality and integrity.
Recommendation
Apply Oracle patches and restrict HTTP access for low-privileged users.
Original NVD description (English source)
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).