CVE-2026-60335: Oracle WebCenter Content Privilege Escalation

CVE-2026-60335 Overview

CVE-2026-60335 is a high-severity vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware, specifically in the Content Server component. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A high-privileged attacker with network access via HTTP can exploit this weakness to compromise Oracle WebCenter Content. Successful exploitation results in complete takeover of the affected instance, impacting confidentiality, integrity, and availability.

Critical Impact
Successful exploitation permits full takeover of Oracle WebCenter Content, exposing stored content, configurations, and downstream services to unauthorized access and modification.

Affected Products

Oracle WebCenter Content 12.2.1.4.0
Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware — Content Server component

Discovery Timeline

2026-07-21 - CVE-2026-60335 published to NVD
2026-07-23 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update: July 2026

Technical Details for CVE-2026-60335

Vulnerability Analysis

The vulnerability resides in the Content Server component of Oracle WebCenter Content, a document and records management platform in Oracle Fusion Middleware. An authenticated attacker holding elevated privileges can send crafted HTTP requests to the Content Server and gain full control of the WebCenter Content instance. Because the attack traverses the network without user interaction and has low attack complexity, exploitation is straightforward once the required privilege is obtained. The scope remains unchanged, but confidentiality, integrity, and availability are all fully impacted.

Oracle classifies this as an "easily exploitable" issue against a privileged account, which increases the risk from insider threats and from adjacent attackers who first compromise a service or administrator credential.

Root Cause

Oracle has not published a detailed root-cause analysis. The advisory attributes the flaw to a defect in the Content Server component that allows a high-privileged authenticated user to bypass intended security boundaries via HTTP-facing functionality. Refer to the Oracle Security Alert: July 2026 for vendor-published details.

Attack Vector

Exploitation requires network reachability to the Content Server HTTP interface and valid credentials for an account with elevated privileges. No user interaction is required. An attacker who has phished, brute-forced, or otherwise obtained a privileged WebCenter Content account can issue crafted HTTP requests to escalate to full instance takeover. The public EPSS score is 0.342%.

No public proof-of-concept exploit code has been released. Technical details are limited to the Oracle Critical Patch Update advisory.

Detection Methods for CVE-2026-60335

Indicators of Compromise

Unexpected administrative HTTP requests to Content Server endpoints originating from non-administrative networks or unusual user agents.
Creation, modification, or export of high-value content items by privileged accounts outside normal business hours.
New or modified Content Server configuration entries, component deployments, or scheduled jobs that were not authorized through change management.
Authentication events for privileged WebCenter Content accounts from previously unseen source IP addresses or geolocations.

Detection Strategies

Review Content Server audit logs and web-tier access logs for anomalous requests issued by administrative accounts.
Correlate WebCenter Content authentication events with identity provider logs to identify credential misuse against high-privilege roles.
Baseline normal administrative activity, then alert on deviations such as bulk downloads, permission changes, or new component installations.

Monitoring Recommendations

Forward Oracle WebCenter Content and Fusion Middleware logs to a centralized SIEM or data lake for retention and correlation.
Monitor privileged account sessions with session recording where available and alert on new administrator role assignments.
Track outbound network connections from the Content Server host to detect data exfiltration following a successful takeover.

How to Mitigate CVE-2026-60335

Immediate Actions Required

Apply the fixes shipped in the Oracle Critical Patch Update: July 2026 to all Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 deployments.
Inventory all Oracle Fusion Middleware Content Server instances, including non-production, and validate patch status.
Rotate credentials for high-privilege WebCenter Content accounts and review recent administrative activity for signs of misuse.
Restrict HTTP access to Content Server management endpoints to trusted management networks.

Patch Information

Oracle addressed CVE-2026-60335 in the July 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the Oracle Security Alert: July 2026 for Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. Follow Oracle's documented pre-patch backup and post-patch validation procedures.

Workarounds

Enforce least privilege on WebCenter Content roles and remove standing administrative access from accounts that do not require it.
Require phishing-resistant multi-factor authentication for all privileged Fusion Middleware accounts to raise the bar for credential-based attacks.
Place the Content Server behind a reverse proxy or web application firewall that restricts administrative URIs to allow-listed source addresses.
Increase audit logging verbosity on Content Server and forward logs to an out-of-band collector to preserve evidence.

bash

# Configuration example: restrict Content Server admin paths at the reverse proxy
# (nginx example — adapt paths to your environment)
location ~* ^/(cs|adfAuthentication|_ocsh)/ {
    allow 10.10.20.0/24;   # management subnet
    deny  all;
    proxy_pass http://webcenter_content_upstream;
}