CVE-2026-60470: Oracle WebCenter Content Auth Bypass Flaw

CVE-2026-60470 Overview

CVE-2026-60470 affects the WebCenter Content: Imaging product within Oracle Fusion Middleware. The flaw resides in the Core component and impacts supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can exploit the issue when a separate user is tricked into interacting with attacker-controlled content. Successful exploitation crosses a security scope boundary and can compromise confidentiality and integrity of data accessible to WebCenter Content: Imaging, as well as adjacent products.

Critical Impact
Attackers can achieve unauthorized read, creation, deletion, or modification of critical data across WebCenter Content: Imaging and connected systems, with a scope change amplifying the blast radius.

Affected Products

Oracle Fusion Middleware – WebCenter Content: Imaging 12.2.1.4.0
Oracle Fusion Middleware – WebCenter Content: Imaging 14.1.2.0.0
Core component of WebCenter Content: Imaging

Discovery Timeline

2026-07-21 - CVE-2026-60470 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update advisory

Technical Details for CVE-2026-60470

Vulnerability Analysis

The vulnerability exists in the Core component of Oracle WebCenter Content: Imaging. An authenticated attacker with only low privileges can send crafted HTTP requests to the application. Exploitation requires human interaction from a user other than the attacker, typically achieved through social engineering such as tricking a victim into visiting a link or loading attacker-supplied content.

Because the flaw introduces a scope change, its effects extend beyond WebCenter Content: Imaging into other integrated Oracle Fusion Middleware components. Successful exploitation yields unauthorized read, write, or delete access to critical data. Confidentiality and integrity are impacted at a high level, while availability remains unaffected. The EPSS probability is 0.246% at the 15.912 percentile, indicating limited near-term exploitation likelihood at the time of publication.

Root Cause

Oracle has not published detailed root-cause analysis. Based on the CVSS metrics and the interaction requirement, the flaw is consistent with a client-assisted web application vulnerability class such as cross-site scripting or cross-site request forgery within the Imaging Core module. The scope change indicates that the vulnerable component executes actions or exposes data belonging to a security authority beyond its own.

Attack Vector

Exploitation proceeds over the network via HTTP. The attacker authenticates with a low-privilege account, then crafts a request or resource that, when acted upon by another authenticated user, causes the Imaging Core to perform unauthorized data operations under the victim's session context. See the Oracle Critical Patch Update July 2026 advisory for vendor guidance.

No public proof-of-concept or exploit code is available at this time.

Detection Methods for CVE-2026-60470

Indicators of Compromise

Unexpected HTTP POST or PUT requests to WebCenter Content: Imaging endpoints originating from low-privilege user sessions
Data creation, modification, or deletion events in Imaging repositories that lack a corresponding legitimate workflow trigger
Referer headers pointing to external or untrusted origins on requests that mutate Imaging content
Session activity where a privileged user's account performs Imaging operations shortly after clicking an external link

Detection Strategies

Enable verbose audit logging on WebCenter Content: Imaging and forward events to a centralized analytics platform for correlation
Baseline normal HTTP request patterns to Imaging endpoints and alert on deviations, especially cross-origin submissions
Inspect web server logs for requests that combine low-privilege authentication with actions typically requiring elevated roles
Deploy a web application firewall in front of Fusion Middleware to flag anomalous parameters and payloads targeting Imaging URLs

Monitoring Recommendations

Continuously monitor the Oracle Fusion Middleware audit trail for unauthorized CREATE, UPDATE, and DELETE operations on document metadata
Track authentication events for accounts that access Imaging shortly after receiving external email or chat links
Correlate Imaging activity with identity provider logs to detect scope-crossing actions against adjacent Fusion Middleware products

How to Mitigate CVE-2026-60470

Immediate Actions Required

Apply the fixes bundled in the Oracle Critical Patch Update July 2026 to all affected WebCenter Content: Imaging deployments
Inventory Fusion Middleware environments to confirm all instances of versions 12.2.1.4.0 and 14.1.2.0.0 are identified and scheduled for patching
Restrict network reachability of the Imaging application to trusted user segments while patching is in progress
Review recent Imaging audit logs for signs of exploitation prior to patch deployment

Patch Information

Oracle addressed CVE-2026-60470 in the July 2026 Critical Patch Update. Administrators should download the corresponding patch bundle for their Oracle Fusion Middleware release and follow Oracle's standard patching procedure for WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0. Refer to the Oracle Critical Patch Update July 2026 advisory for exact patch identifiers and installation steps.

Workarounds

Enforce strict same-origin and referer validation at a reverse proxy or WAF in front of WebCenter Content: Imaging
Reduce the number of accounts with any level of Imaging access until patches are applied, following least-privilege principles
Provide targeted user awareness guidance so authenticated users avoid clicking untrusted links while logged into Fusion Middleware
Segment WebCenter Content: Imaging from other Fusion Middleware components to limit scope-change impact

bash

# Configuration example - restrict Imaging access at reverse proxy (nginx)
location /imaging/ {
    # Allow only trusted internal ranges
    allow 10.10.0.0/16;
    deny  all;

    # Enforce same-origin for state-changing methods
    if ($request_method ~ ^(POST|PUT|DELETE)$) {
        set $block 1;
    }
    if ($http_referer !~* "^https://webcenter\.internal\.example\.com/") {
        set $block "${block}1";
    }
    if ($block = "11") {
        return 403;
    }

    proxy_pass https://fusion-middleware-backend;
}