CVE-2026-60435 Overview
CVE-2026-60435 is a critical vulnerability in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can compromise the product without user interaction. Successful exploitation results in full takeover of Oracle WebCenter Content, impacting confidentiality, integrity, and availability. Oracle disclosed the flaw in its July 2026 Critical Patch Update. Affected supported versions are 12.2.1.4.0 and 14.1.2.0.0.
Critical Impact
An unauthenticated remote attacker can take over Oracle WebCenter Content over HTTP without user interaction, exposing enterprise content repositories to complete compromise.
Affected Products
- Oracle WebCenter Content 12.2.1.4.0
- Oracle WebCenter Content 14.1.2.0.0
- Oracle Fusion Middleware — Content Server component
Discovery Timeline
- 2026-07-21 - CVE-2026-60435 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Addressed in the Oracle Security Alert July 2026
Technical Details for CVE-2026-60435
Vulnerability Analysis
The flaw resides in the Content Server component of Oracle WebCenter Content. It is remotely exploitable over HTTP and requires no authentication, credentials, or user interaction. Oracle classifies the issue as easily exploitable, meaning an attacker can reach the vulnerable functionality directly through exposed web endpoints.
Successful exploitation yields full takeover of Oracle WebCenter Content. This includes the ability to read, modify, and destroy managed content, as well as execute operations that undermine the availability of the platform. Because WebCenter Content typically stores regulated documents, contracts, and records, compromise can cascade into broader data exposure.
The EPSS probability for this CVE is 0.358% as of 2026-07-23, indicating limited observed exploitation activity to date. Organizations should not treat a low EPSS as a reason to delay remediation, given the criticality and network reachability of the affected component.
Root Cause
Oracle has not published detailed root-cause information beyond the advisory. The vulnerability is reachable through the Content Server's HTTP interface and does not enforce authentication prior to executing the affected code path. See the Oracle Security Alert July 2026 for vendor guidance.
Attack Vector
An attacker sends crafted HTTP requests to an internet-facing or network-reachable Oracle WebCenter Content instance. No credentials, prior access, or user interaction are required. Exploitation proceeds directly from network traffic to code execution within the Content Server context, resulting in complete takeover of the application.
No public proof-of-concept code has been released at the time of this writing. Verified exploitation details are described in prose only, per available public sources.
Detection Methods for CVE-2026-60435
Indicators of Compromise
- Anomalous unauthenticated HTTP requests to Content Server endpoints, particularly to administrative or upload paths.
- Unexpected creation, modification, or deletion of documents and metadata in the WebCenter Content repository.
- New processes, scripts, or scheduled tasks spawned by the WebLogic or Content Server service accounts.
- Outbound network connections from the Content Server host to unknown external IP addresses.
Detection Strategies
- Inspect web server and reverse proxy logs for unauthenticated requests that return successful status codes on privileged Content Server actions.
- Correlate WebCenter audit logs with authentication logs to identify actions occurring without a valid session.
- Baseline normal request patterns and alert on spikes of POST requests to Content Server endpoints from a single source.
Monitoring Recommendations
- Forward WebCenter Content, WebLogic, and host operating system logs to a centralized SIEM for retention and correlation.
- Monitor for lateral movement from the Content Server host to database or file storage tiers.
- Track integrity of on-disk binaries and configuration files under the Oracle Fusion Middleware home directory.
How to Mitigate CVE-2026-60435
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update for Oracle WebCenter Content on all instances running 12.2.1.4.0 or 14.1.2.0.0.
- Inventory internet-exposed WebCenter Content deployments and restrict inbound HTTP access to trusted networks until patched.
- Review Content Server and WebLogic logs for the period preceding patch deployment to identify possible pre-patch exploitation.
Patch Information
Oracle released fixes as part of the Oracle Security Alert July 2026. Administrators must apply the corresponding patch for their specific Oracle WebCenter Content version. Oracle recommends applying Critical Patch Update fixes without delay.
Workarounds
- Place the Content Server behind a web application firewall configured to block unauthenticated access to sensitive endpoints.
- Restrict network exposure of the Content Server to VPN or internal segments only, using firewall rules or reverse-proxy access control lists.
- Enforce strict egress filtering on the Content Server host to limit post-exploitation command-and-control channels.
# Example: restrict inbound HTTP/HTTPS access to Content Server to trusted subnets
iptables -A INPUT -p tcp --dport 16200 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 16200 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
