CVE-2026-60574

MediumCVSS 6.3

Published: 21/07/2026(UTC)Updated: 06/08/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Vulnerability in Oracle Content Manager (component: Cover Letter) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized read, write, and delete access to data and cause a partial denial of service.

Risk Assessment

Risk includes compromise of confidentiality, integrity, and availability of Oracle Content Manager data, potentially leading to data leakage and system disruption.

Recommendation

Apply patches provided by Oracle for versions 12.2.3-12.2.15 immediately and restrict network access to the component.

Other vulnerabilities in Oracle Content Manager

CVE-2026-60691High
Vulnerability in Oracle Content Manager (Internal Operations component) in Oracle E-Business Suite versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and the ability to create, delete, or modify it.

Original NVD description (English source)

Vulnerability in the Oracle Content Manager product of Oracle E-Business Suite (component: Cover Letter). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Content Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Content Manager accessible data as well as unauthorized read access to a subset of Oracle Content Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Content Manager. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).