CVE-2026-60472 Overview
CVE-2026-60472 is a high-severity vulnerability in the Core component of Oracle WebCenter Content: Imaging, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise the affected product. Successful exploitation results in full takeover of WebCenter Content: Imaging, impacting confidentiality, integrity, and availability. Oracle addressed the issue in the July 2026 Critical Patch Update.
Critical Impact
Authenticated network attackers can achieve complete takeover of Oracle WebCenter Content: Imaging deployments, exposing document repositories and imaging workflows to unauthorized modification and disclosure.
Affected Products
- Oracle WebCenter Content: Imaging 12.2.1.4.0
- Oracle WebCenter Content: Imaging 14.1.2.0.0
- Oracle Fusion Middleware (Core component)
Discovery Timeline
- 2026-07-21 - CVE-2026-60472 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Oracle releases security patch via Critical Patch Update
Technical Details for CVE-2026-60472
Vulnerability Analysis
The vulnerability resides in the Core component of Oracle WebCenter Content: Imaging, a product used to manage document imaging, capture, and workflow processes. Oracle categorizes the flaw as easily exploitable over HTTP, requiring only low privileges and no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the target service.
Because the attack scope is unchanged and impacts are high across all three CIA dimensions, an attacker with a valid low-privileged account can pivot to full application takeover. This includes control over stored imaging content, workflow configuration, and any integrated Fusion Middleware services.
The EPSS probability is 0.328% with a percentile of 25.17, indicating limited public exploitation activity at time of publication.
Root Cause
Oracle has not publicly disclosed the underlying weakness type or CWE classification. The advisory indicates the flaw is reachable through the HTTP interface exposed by the Imaging application and is exploitable by authenticated users with minimal privileges. Refer to the Oracle Security Alert July 2026 for vendor guidance.
Attack Vector
The attack vector is network-based over HTTP. An attacker requires a valid low-privilege account on the target WebCenter Content: Imaging instance. Once authenticated, the attacker sends crafted HTTP requests to the vulnerable Core endpoint to achieve compromise. No user interaction is required, and the attack complexity is low.
No verified public proof-of-concept code has been published. See the Oracle Security Alert July 2026 for authoritative vendor information.
Detection Methods for CVE-2026-60472
Indicators of Compromise
- Unexpected HTTP requests to WebCenter Content: Imaging endpoints originating from low-privileged accounts
- New or modified imaging workflow configurations, administrative users, or content repository ACLs
- Anomalous outbound connections from the Fusion Middleware host following authenticated Imaging sessions
Detection Strategies
- Review Oracle Fusion Middleware access logs for authenticated sessions issuing unusual request patterns to the Imaging Core component
- Correlate low-privilege account logins with subsequent privileged operations inside WebCenter Content: Imaging
- Baseline normal Imaging HTTP traffic and alert on deviations in request volume, path, or payload size
Monitoring Recommendations
- Forward WebLogic and WebCenter access, audit, and diagnostic logs to a centralized analytics platform for retention and correlation
- Monitor administrative and content management APIs for changes performed by non-administrative accounts
- Alert on failed-then-successful authentication patterns targeting Imaging service accounts
How to Mitigate CVE-2026-60472
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle WebCenter Content: Imaging deployments running 12.2.1.4.0 or 14.1.2.0.0
- Inventory all Fusion Middleware instances and confirm the Imaging component patch level
- Restrict network access to the Imaging HTTP interface to trusted management networks until patching completes
- Rotate credentials for low-privileged Imaging accounts and enforce strong authentication
Patch Information
Oracle released the fix as part of the July 2026 Critical Patch Update. Administrators should download and apply the update following the guidance in the Oracle Security Alert July 2026. Validate the patch in a non-production environment before rolling out to production Fusion Middleware clusters.
Workarounds
- Limit HTTP access to WebCenter Content: Imaging via network segmentation, web application firewall rules, or reverse-proxy allowlists
- Reduce the number of accounts holding any Imaging role until the patch is deployed
- Enable enhanced audit logging on the Imaging application to improve detection during the exposure window
# Example: restrict inbound HTTP access to the Imaging endpoint at the host firewall
# Replace <trusted-cidr> with your management network range
iptables -A INPUT -p tcp --dport 16000 -s <trusted-cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 16000 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
