CVE-2026-60471: Oracle WebCenter Content RCE Vulnerability

CVE-2026-60471 Overview

CVE-2026-60471 is a high-severity vulnerability in the Oracle WebCenter Content: Imaging product, part of Oracle Fusion Middleware. The flaw resides in the Core component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with access to the physical communication segment attached to the hardware running WebCenter Content: Imaging can compromise the product. The vulnerability carries a scope change, meaning successful exploitation can significantly impact additional products beyond the initial target. Oracle addressed this issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation results in complete takeover of WebCenter Content: Imaging, with high impact to confidentiality, integrity, and availability, and potential lateral impact to other components due to scope change.

Affected Products

Oracle WebCenter Content: Imaging 12.2.1.4.0
Oracle WebCenter Content: Imaging 14.1.2.0.0
Oracle Fusion Middleware (Core component)

Discovery Timeline

2026-07-21 - CVE CVE-2026-60471 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addressed the issue in the Oracle Critical Patch Update

Technical Details for CVE-2026-60471

Vulnerability Analysis

The vulnerability affects the Core component of Oracle WebCenter Content: Imaging, an enterprise content management module used to capture, store, and manage business documents. Exploitation does not require authentication or user interaction, but the attacker must be positioned on the same physical communication segment as the target host. This adjacency requirement raises exploitation complexity but does not eliminate risk in shared data center, VLAN, or lab environments.

A successful attack results in complete takeover of the WebCenter Content: Imaging instance, granting the attacker control over stored documents, indexing metadata, and workflow processes. The advisory notes a scope change, indicating that impact extends beyond the vulnerable component to other products or security authorities in the environment. Oracle rates all three impact metrics (confidentiality, integrity, and availability) as high.

Root Cause

Oracle has not published detailed root cause information in the public advisory. The Core component handles imaging workflow, ingestion, and inter-service communication, and the network-adjacent attack vector suggests the flaw involves a service exposed on the local network segment rather than an internet-facing endpoint. Refer to the Oracle Critical Patch Update for vendor-provided technical detail.

Attack Vector

The attack vector is Adjacent Network. An attacker must have a foothold on the same broadcast domain, VLAN, or physical network segment as the WebCenter Content: Imaging host. From that position, the attacker sends crafted network traffic to the vulnerable service without providing credentials. No user interaction is required. Because the vulnerability produces a scope change, follow-on impact can reach neighboring services that trust the compromised imaging host.

No public proof-of-concept code or exploit has been released for CVE-2026-60471 at the time of publication.

Detection Methods for CVE-2026-60471

Indicators of Compromise

Unexpected inbound connections to the WebCenter Content: Imaging host from systems on the same VLAN or physical segment that do not normally communicate with it.
Anomalous process spawning, file writes, or configuration changes on the WebCenter Content: Imaging host outside of scheduled maintenance windows.
New or modified administrative accounts within WebCenter Content: Imaging, or unexpected access to imaging repositories and workflows.

Detection Strategies

Baseline normal network flows to and from Oracle Fusion Middleware hosts, then alert on deviations originating from adjacent hosts.
Monitor WebLogic and WebCenter application logs for unauthenticated requests that trigger administrative or workflow actions.
Correlate host-level telemetry (process creation, file integrity, outbound connections) with network telemetry to identify post-exploitation activity following network anomalies.

Monitoring Recommendations

Enable verbose audit logging on WebCenter Content: Imaging and forward logs to a centralized SIEM or data lake for retention and correlation.
Deploy network segmentation monitoring to identify hosts that gain unexpected Layer 2 adjacency to Fusion Middleware infrastructure.
Track patch state of all Oracle Fusion Middleware installations and alert when hosts drift from the July 2026 CPU baseline.

How to Mitigate CVE-2026-60471

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all WebCenter Content: Imaging deployments running 12.2.1.4.0 or 14.1.2.0.0.
Inventory Oracle Fusion Middleware hosts and confirm which are running the affected Imaging component.
Restrict Layer 2 access to WebCenter Content: Imaging hosts by placing them in dedicated, tightly controlled VLANs.

Patch Information

Oracle released fixes for CVE-2026-60471 as part of the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update Advisory - July 2026 for the correct patch bundle, prerequisite versions, and post-installation validation steps. Apply patches in a staging environment first and verify imaging workflows before rolling to production.

Workarounds

Isolate WebCenter Content: Imaging servers on dedicated network segments and enforce strict access control lists limiting which hosts can reach imaging service ports.
Disable or firewall any non-essential services listening on the imaging host until patching is complete.
Enable enhanced monitoring on adjacent hosts and require jump-host or bastion access for any administrative connections to Fusion Middleware infrastructure.

bash

# Example: restrict adjacent access to WebCenter Content: Imaging host
# Replace interface and CIDR with values appropriate for your environment

# Allow only the management subnet to reach the imaging service
iptables -A INPUT -i eth0 -s 10.10.20.0/24 -p tcp --dport 16000 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 16000 -j DROP

# Log unexpected connection attempts from adjacent hosts
iptables -A INPUT -i eth0 -p tcp --dport 16000 -j LOG --log-prefix "WCCI-ADJ-DENY: "