CVE-2026-60928

Analyzed Analyzed - Analysis Complete

Oracle WebCenter Content Privilege Escalation Vulnerability

Publication date: 2026-08-18

Last updated on: 2026-08-27

Assigner: Oracle

Description

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle WebCenter Content executes to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-27

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-60928

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	webcenter_content	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle WebCenter Content (version 14.1.2.0.0) that allows a low-privileged attacker with local access to compromise the system. It enables unauthorized creation, modification, or deletion of critical data, as well as unauthorized access to all accessible Oracle WebCenter Content data.

Detection Guidance

This vulnerability affects Oracle WebCenter Content version 14.1.2.0.0. Detection requires checking for Oracle WebCenter Content installations and verifying their version. Use commands like 'opatch lsinventory' or check Oracle WebCenter Content logs for unusual activity. Ensure the system is updated to the latest patch.

Impact Analysis

An attacker could gain full access to sensitive data stored in Oracle WebCenter Content, leading to data breaches, data loss, or unauthorized modifications. This could affect business operations, reputation, and compliance with data protection requirements.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle WebCenter Content version 14.1.2.0.0. Restrict user privileges to minimize access to critical data and infrastructure components. Monitor logs for suspicious activities related to data modification or unauthorized access.

Hi! I’m here to help you understand CVE-2026-60928. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70