CVE-2026-60502
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Vulnerability in Oracle Fusion Middleware WebCenter Content: Imaging (Core component). Versions 12.2.1.4.0 and 14.1.2.0.0 are affected. A high-privileged attacker with network access via T3 or IIOP can easily exploit this, leading to full system takeover.
Risk Assessment
Risk of complete compromise of WebCenter Content: Imaging, potentially leading to loss of confidentiality, integrity, and availability.
Recommendation
Apply patches provided by Oracle for versions 12.2.1.4.0 and 14.1.2.0.0. Restrict network access to T3 and IIOP interfaces.
Other vulnerabilities in Oracle Fusion Middleware
See all- CVE-2026-60388Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (T3, IIOP) can take over the platform.
- CVE-2026-60387Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (T3, IIOP) can take over the platform.
- CVE-2026-60380Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (HTTP) can take over the platform.
- CVE-2026-60374Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (T3, IIOP) can take over the platform.
- CVE-2026-61099High
Vulnerability in Oracle WebCenter Enterprise Capture product (Oracle Fusion Middleware) in Client Bundle component. Affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the system.
- CVE-2026-61098High
Vulnerability in Oracle WebCenter Enterprise Capture product (Oracle Fusion Middleware) in Client Bundle component. Affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the system.
- CVE-2026-60657High
Vulnerability in Oracle WebCenter Content (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, requires low privileges and user interaction, but may affect other products. Allows unauthorized access and modification of critical data.
- CVE-2026-60654High
Vulnerability in Oracle WebCenter Content (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the system.
- CVE-2026-60563High
Vulnerability in Oracle WebCenter Portal (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the portal.
- CVE-2026-60553High
Vulnerability in Oracle WebCenter Sites (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, allows an unauthenticated attacker via HTTP to gain unauthorized access and modification of critical data, with possible impact on other products.
Original NVD description (English source)
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via T3, IIOP to compromise WebCenter Content: Imaging. Successful attacks of this vulnerability can result in takeover of WebCenter Content: Imaging. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).