CVE-2026-60463: Oracle WebCenter Content Auth Bypass Flaw

CVE-2026-60463 Overview

CVE-2026-60463 is a critical remote takeover vulnerability in the Oracle WebCenter Content: Imaging product, part of Oracle Fusion Middleware. The flaw resides in the Core component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via the T3 or IIOP protocols can exploit the issue without user interaction. Successful exploitation results in full compromise of the WebCenter Content: Imaging instance, impacting confidentiality, integrity, and availability. Oracle addressed the flaw in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can achieve complete takeover of Oracle WebCenter Content: Imaging over T3 or IIOP, exposing document imaging workflows and connected Fusion Middleware components.

Affected Products

Oracle WebCenter Content: Imaging 12.2.1.4.0
Oracle WebCenter Content: Imaging 14.1.2.0.0
Oracle Fusion Middleware (Core component)

Discovery Timeline

2026-07-21 - CVE-2026-60463 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60463

Vulnerability Analysis

The vulnerability affects the Core component of Oracle WebCenter Content: Imaging within Oracle Fusion Middleware. Exposure occurs through the T3 and Internet Inter-ORB Protocol (IIOP) remote interfaces used by WebLogic-based Fusion Middleware deployments. An unauthenticated attacker reaching these listeners over the network can trigger the flaw with low attack complexity and no user interaction. Successful exploitation yields complete takeover of the Imaging service, including full read, write, and disruption capabilities on stored content and configuration. The Oracle advisory categorizes the impact against confidentiality, integrity, and availability at the highest level, consistent with unauthenticated remote code execution behavior historically seen on T3 and IIOP endpoints. The EPSS probability for exploitation within 30 days is 0.358% at the 28.264 percentile as of 2026-07-23.

Root Cause

Oracle has not publicly disclosed the underlying CWE or root cause classification. Similar T3 and IIOP flaws in Oracle Fusion Middleware historically stem from insecure deserialization of untrusted Java objects processed by WebLogic RMI listeners. Refer to the Oracle Security Alert - July 2026 for authoritative details.

Attack Vector

The attack vector is network-based over T3 or IIOP. These protocols are the default RMI transports for Oracle WebLogic Server, which hosts WebCenter Content: Imaging. An attacker crafts a malicious request to the exposed listener port, typically the same port used by administrative and application traffic. Because no authentication, privileges, or user interaction are required, any host that can reach the T3 or IIOP port can attempt exploitation. Environments that expose WebLogic listener ports to internal segments or the internet are at highest risk.

No verified public proof-of-concept code is available. Refer to the vendor advisory for technical remediation guidance.

Detection Methods for CVE-2026-60463

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 or IIOP listener ports from untrusted sources.
Anomalous Java process spawning shells, cmd.exe, or powershell.exe from the WebLogic or WebCenter Imaging service account.
New or modified files under the Imaging domain directories, including unexpected .jar, .war, or JSP artifacts.
Outbound network connections from the WebCenter Imaging host to unfamiliar external hosts following T3/IIOP traffic.

Detection Strategies

Inspect WebLogic access and server logs for T3 or IIOP requests carrying serialized Java payloads or unusual class references.
Monitor child processes of the WebLogic Java process for command interpreters or scripting engines that indicate post-exploitation activity.
Correlate authentication-free network access to Fusion Middleware listener ports with subsequent process, file, or registry changes on the host.

Monitoring Recommendations

Enable audit logging on WebLogic administrative and application listeners and forward events to a centralized analytics platform.
Baseline expected client IPs for T3 and IIOP traffic and alert on deviations.
Track file integrity for Imaging domain, deployment, and configuration directories.

How to Mitigate CVE-2026-60463

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all WebCenter Content: Imaging deployments running 12.2.1.4.0 or 14.1.2.0.0.
Restrict network access to WebLogic T3 and IIOP listener ports to trusted management networks using firewall rules.
Inventory all Fusion Middleware hosts and confirm patch status through Oracle Opatch reporting.

Patch Information

Oracle released fixes for CVE-2026-60463 in the July 2026 Critical Patch Update. Review the Oracle Security Alert - July 2026 for the specific patch bundle, applicability matrix, and installation instructions for each affected version.

Workarounds

Use the WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP traffic from untrusted sources until patching is complete.
Disable IIOP in the WebLogic Server console where the protocol is not required by applications.
Place Fusion Middleware administrative and RMI interfaces behind a VPN or jump host to eliminate direct exposure.

bash

# Example WebLogic connection filter rules to block T3/IIOP from untrusted networks
# Set in the Admin Console: Security > Filter > Connection Filter Rules
# Format: target localAddress localPort action protocols

10.0.0.0/8   * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops