CVE-2026-60443: Oracle WebCenter Content Privilege Escalation

CVE-2026-60443 Overview

CVE-2026-60443 is a high-severity vulnerability in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware. Supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected. A low-privileged attacker with network access over HTTP can exploit the flaw when a separate user performs an interaction, such as clicking a crafted link. Successful exploitation causes a scope change, allowing attackers to read, create, delete, or modify all data accessible to Oracle WebCenter Content and impact adjacent products. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Attackers can compromise the confidentiality and integrity of all Oracle WebCenter Content accessible data and pivot to adjacent products through a scope change.

Affected Products

Oracle WebCenter Content 12.2.1.4.0
Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware — Content Server component

Discovery Timeline

2026-07-21 - CVE-2026-60443 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-60443

Vulnerability Analysis

The vulnerability resides in the Content Server component of Oracle WebCenter Content. An authenticated attacker with low privileges can send a crafted HTTP request that, when combined with an action taken by another user, results in unauthorized data operations. The flaw triggers a scope change, meaning exploitation impacts resources beyond the vulnerable component itself. Successful attacks yield read access to all data stored or referenced by WebCenter Content, as well as the ability to create, modify, or delete that data. Availability is not affected, but the confidentiality and integrity impact extends to any downstream systems that trust Content Server output.

Because the attack requires a victim user to perform an interaction, the exploitation pattern is consistent with request forgery or reflected content injection primitives triggered through the Content Server interface. Oracle has not published root-cause details beyond the July 2026 advisory.

Root Cause

Oracle's advisory does not enumerate the underlying weakness class, and no CWE is assigned in NVD. The behavior — low-privilege network access, required user interaction, and a cross-scope impact — is characteristic of insufficient validation of user-supplied input processed by Content Server on behalf of another authenticated session.

Attack Vector

Exploitation requires network access to the Content Server over HTTP, valid low-privileged credentials, and an interaction from a different user. No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data as of 2026-07-23 shows a probability of 0.323% at the 24.63 percentile, indicating no observed exploitation activity at publication time.

No verified exploitation code is available. Refer to the Oracle Critical Patch Update July 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-60443

Indicators of Compromise

Unexpected HTTP requests to Content Server endpoints originating from low-privileged accounts followed by administrative-scope data changes.
Content Server audit log entries showing document creation, modification, or deletion tied to sessions that did not initiate the action interactively.
Outbound requests or cross-application activity from WebCenter Content hosts that correlate with the scope change described in the advisory.

Detection Strategies

Compare Content Server access logs against identity provider logs to flag actions attributed to users who were not actively authenticated at the time.
Alert on HTTP requests to Content Server that carry crafted parameters targeting document metadata, workflow, or check-in and check-out endpoints from unusual referrers.
Baseline normal document lifecycle operations per user role and alert on deviations, particularly bulk creation, deletion, or permission modification.

Monitoring Recommendations

Forward Oracle WebCenter Content Server logs, WebLogic access logs, and reverse-proxy logs to a centralized SIEM for correlation.
Monitor for authentication events from low-privileged accounts followed by privilege-sensitive Content Server actions within short time windows.
Track anomalous session reuse patterns and referrer headers pointing at attacker-controlled domains that could stage the required user interaction.

How to Mitigate CVE-2026-60443

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update July 2026 to Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 deployments.
Inventory all Oracle Fusion Middleware installations exposing Content Server over HTTP or HTTPS and prioritize internet-facing instances.
Rotate credentials and review audit logs for low-privileged accounts that could have been abused during the exposure window.

Patch Information

Oracle released patches for CVE-2026-60443 as part of the July 2026 Critical Patch Update. Administrators should follow the pre-installation and post-installation steps documented in the advisory and validate that both 12.2.1.4.0 and 14.1.2.0.0 instances receive the corresponding patch bundle.

Workarounds

Restrict HTTP access to Content Server to trusted network segments and authenticated users only, using a reverse proxy or web application firewall.
Enforce strict Content Security Policy and SameSite cookie settings on WebCenter Content sessions to reduce the impact of user-interaction-driven attacks.
Limit the number of accounts with any level of Content Server access and review role assignments to remove unnecessary low-privileged users until patching completes.

bash

# Configuration example: restrict Content Server access at the reverse proxy
# (Apache httpd example — adjust CIDR ranges and paths to your environment)
<Location "/cs">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
    Header always set Content-Security-Policy "default-src 'self'"
    Header always set Set-Cookie "Path=/; Secure; HttpOnly; SameSite=Strict"
</Location>