CVE-2026-60574

Analyzed Analyzed - Analysis Complete

Unauthorized Data Access in Oracle Content Manager

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description

Vulnerability in the Oracle Content Manager product of Oracle E-Business Suite (component: Cover Letter). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Content Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Content Manager accessible data as well as unauthorized read access to a subset of Oracle Content Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Content Manager. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60574

EUVD

EUVD-2026-46936

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	content_manager	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Content Manager, part of Oracle E-Business Suite. It allows a low-privileged attacker with network access to exploit it via HTTP. Successful exploitation can lead to unauthorized data access or modification, as well as partial denial of service.

Detection Guidance

This vulnerability affects Oracle Content Manager in Oracle E-Business Suite versions 12.2.3 to 12.2.15. Detection requires checking for unauthorized access or modifications to Oracle Content Manager data via HTTP. Review application logs for unusual activity, such as unexpected data changes or access patterns. Ensure your Oracle E-Business Suite instance is updated to the latest patch level.

Impact Analysis

If exploited, an attacker could read, modify, or delete some data in Oracle Content Manager. They could also disrupt service availability, though only partially. This requires low privileges and network access.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, which may violate GDPR (data protection) or HIPAA (health data privacy) requirements. Organizations using affected versions must address it to maintain compliance.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite to address this vulnerability. Restrict network access to Oracle Content Manager via HTTP to trusted sources only. Implement strong authentication and authorization controls for low-privileged users. Monitor for signs of exploitation and review logs regularly.

Hi! I’m here to help you understand CVE-2026-60574. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70