Oracle has disclosed CVE-2026-60905, a critical (CVSS 9.6) vulnerability in the Content Server component of Oracle WebCenter Content that lets an unauthenticated remote attacker fully compromise the product and reach beyond it.
What Is It
The flaw sits in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware. Oracle describes it as easily exploitable: an unauthenticated attacker with network access over HTTP can compromise the product. Exploitation does require human interaction from a person other than the attacker; meaning an operator or user has to be lured into taking some action for the attack to land.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L, scoring 9.6 CRITICAL. Notably, the scope is changed (S:C), so successful attacks may significantly impact products beyond WebCenter Content itself.
Why It Matters
Successful exploitation yields unauthorized creation, deletion, or modification of critical data, or all data accessible to WebCenter Content, plus unauthorized read access to that same critical data, and the ability to cause a partial denial of service.
That combination is the worst case for a document and content management platform: WebCenter Content is where organizations park contracts, records, and internal documents. Full read plus full write against that store, from an unauthenticated network position, is a direct path to data theft and tampering. The scope change means the blast radius does not stop at WebCenter Content.
There is currently no CISA KEV entry for this CVE, so active exploitation has not been confirmed by CISA at time of writing. The low attack complexity and lack of required privileges make it an attractive target regardless.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle WebCenter Content (Oracle Fusion Middleware), component: Content Server
- Affected supported versions: 12.2.1.4.0 and 14.1.2.0.0
Patch Status
The CVE was published 2026-08-18 and is referenced in Oracle's August 2026 Critical Patch Update advisory. Administrators running the affected versions should apply the fixes from that advisory. No KEV-mandated remediation deadline exists for this CVE at this time.
Sources
- NVD, CVE-2026-60905 record (source: [email protected]), published 2026-08-18
- Oracle Critical Patch Update Advisory; August 2026: https://www.oracle.com/security-alerts/cspuaug2026.html