CVE-2026-60467: Oracle WebCenter Content Auth Bypass Flaw

CVE-2026-60467 Overview

CVE-2026-60467 affects the Oracle WebCenter Content: Imaging product within Oracle Fusion Middleware, specifically the Core component. Supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected. An unauthenticated remote attacker with network access via HTTP can compromise the product, though exploitation is difficult and requires interaction from a victim user. Successful exploitation results in full takeover of WebCenter Content: Imaging, impacting confidentiality, integrity, and availability.

Critical Impact
Successful exploitation leads to complete takeover of Oracle WebCenter Content: Imaging deployments, compromising confidentiality, integrity, and availability of managed content.

Affected Products

Oracle Fusion Middleware WebCenter Content: Imaging 12.2.1.4.0
Oracle Fusion Middleware WebCenter Content: Imaging 14.1.2.0.0
Oracle Fusion Middleware Core component

Discovery Timeline

2026-07-21 - CVE CVE-2026-60467 published to NVD
2026-07-23 - Last updated in NVD database
Referenced in Oracle Security Alert July 2026

Technical Details for CVE-2026-60467

Vulnerability Analysis

The flaw resides in the Core component of Oracle WebCenter Content: Imaging, an enterprise content management module used to capture, store, and route business documents. An unauthenticated attacker can reach the vulnerable functionality remotely over HTTP. Exploitation requires user interaction from a person other than the attacker, typically involving actions such as opening a crafted link or interacting with attacker-controlled content within an authenticated session. When conditions align, the attacker gains the ability to compromise the Imaging service and take control of managed data flows.

Oracle classifies exploitation as difficult, reflecting non-trivial conditions such as timing, environment-specific configuration, or the need to bait an authorized user into performing a specific action. The impact spans confidentiality, integrity, and availability.

Root Cause

Oracle has not publicly disclosed a CWE classification or code-level analysis for CVE-2026-60467. Based on the CVSS characteristics, the vulnerability is reachable over the network without credentials but relies on victim participation, consistent with client-side triggered flaws such as cross-site request forgery, response handling errors, or unsafe processing of attacker-influenced input surfaced through a user action. Refer to the Oracle Security Alert July 2026 for authoritative details.

Attack Vector

Attackers deliver a crafted HTTP request or link to a user with access to a WebCenter Content: Imaging deployment. Once the victim interacts with the malicious content, the request is processed in the context of the Imaging service, permitting takeover of the application. No credentials are required from the attacker. Public proof-of-concept code is not available, and no exploitation in the wild has been reported. The EPSS probability is 0.31%.

No verified exploitation code is available for this vulnerability. See the Oracle Security Alert July 2026 for vendor guidance.

Detection Methods for CVE-2026-60467

Indicators of Compromise

Unexpected administrative or configuration changes within Oracle WebCenter Content: Imaging repositories, workflows, or user accounts.
HTTP requests to Imaging endpoints containing anomalous parameters, unusual referrers, or origins outside of trusted user workflows.
New or modified content, ingestion rules, or output routing that does not correspond to authorized change tickets.

Detection Strategies

Enable and review WebLogic and WebCenter access logs for requests to Imaging URIs paired with external referrers or off-hours user activity.
Correlate authenticated user session activity with browser-driven requests originating from external domains to identify interaction-triggered exploitation attempts.
Baseline normal Imaging API usage patterns and alert on deviations, particularly administrative operations invoked through user-initiated navigation.

Monitoring Recommendations

Forward Oracle Fusion Middleware, WebLogic, and Imaging audit logs to a centralized SIEM for retention and correlation.
Monitor privileged account activity within Imaging for changes to permissions, retention policies, and workflow configuration.
Track outbound connections from Fusion Middleware hosts that could indicate post-exploitation data movement.

How to Mitigate CVE-2026-60467

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected WebCenter Content: Imaging deployments running 12.2.1.4.0 or 14.1.2.0.0.
Inventory Fusion Middleware environments to confirm patch coverage and identify unmanaged instances.
Restrict network exposure of Imaging endpoints to trusted internal networks and authenticated users only.

Patch Information

Oracle addressed CVE-2026-60467 in the July 2026 Critical Patch Update. Refer to the Oracle Security Alert July 2026 for patch identifiers, applicable versions, and installation instructions. Oracle recommends applying Critical Patch Update fixes without delay.

Workarounds

Place Imaging endpoints behind a reverse proxy or web application firewall with strict referrer, origin, and CSRF token enforcement.
Require users to access WebCenter Content: Imaging only from managed browsers or dedicated administrative workstations to reduce exposure to crafted external content.
Educate privileged users to avoid interacting with untrusted links while authenticated to Fusion Middleware consoles.

bash

# Configuration example: restrict access to WebCenter Content: Imaging via reverse proxy
# Example nginx snippet limiting Imaging endpoints to trusted networks
location /imaging/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_set_header X-Frame-Options "DENY";
    proxy_pass https://wcc-imaging-backend.internal;
}