CVE-2026-60640 Overview
CVE-2026-60640 is a vulnerability in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware. Supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected. An unauthenticated attacker with network access via HTTP can exploit the flaw, but successful exploitation requires human interaction from a user other than the attacker. The scope change indicates that a successful attack can impact additional products beyond Oracle WebCenter Content itself. Oracle disclosed the issue as part of the July 2026 Critical Patch Update.
Critical Impact
Successful exploitation can result in full takeover of Oracle WebCenter Content with high impact to confidentiality, integrity, and availability.
Affected Products
- Oracle WebCenter Content 12.2.1.4.0
- Oracle WebCenter Content 14.1.2.0.0
- Oracle Fusion Middleware (Content Server component)
Discovery Timeline
- 2026-07-21 - CVE-2026-60640 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Addressed in the Oracle Security Alert July 2026
Technical Details for CVE-2026-60640
Vulnerability Analysis
The vulnerability resides in the Content Server component of Oracle WebCenter Content. An unauthenticated attacker can reach the vulnerable code path over the network using HTTP. Exploitation is rated as high complexity, meaning the attacker must overcome conditions outside their direct control before the attack succeeds.
The flaw carries a scope change, indicating that resources beyond the vulnerable component are impacted when exploitation succeeds. This behavior is common when a content management server interacts with downstream systems, backend databases, or authenticated user sessions. Successful attacks compromise confidentiality, integrity, and availability at the highest level, resulting in takeover of the product.
The EPSS probability for this CVE is 0.31% as of 2026-07-23.
Root Cause
Oracle has not publicly disclosed the specific root cause. Given that exploitation requires user interaction from a person other than the attacker and produces a scope change, the flaw likely involves processing of attacker-supplied content that is later rendered or executed in the context of an authenticated user or downstream service.
Attack Vector
The attack vector is network-based over HTTP. The attacker sends a crafted request or supplies malicious content to the Content Server. A separate user must then interact with that content, triggering the vulnerable code path. The high attack complexity indicates the attacker must satisfy timing, configuration, or interaction preconditions to succeed.
No verified exploit code or public proof-of-concept is available. Refer to the Oracle Security Alert July 2026 for vendor guidance.
Detection Methods for CVE-2026-60640
Indicators of Compromise
- Unexpected HTTP requests targeting Content Server endpoints from unauthenticated sources.
- Anomalous document uploads, check-ins, or metadata modifications performed shortly before privileged user interaction.
- New administrative accounts, altered access control lists, or unexpected changes to Content Server configuration.
- Outbound connections from the WebCenter Content host to systems it does not normally communicate with, consistent with scope change impact.
Detection Strategies
- Enable and centralize Content Server access and audit logs, and alert on unauthenticated requests to sensitive endpoints.
- Correlate document interaction events with subsequent privileged actions to identify user-interaction-triggered exploitation.
- Baseline normal HTTP request patterns to the Content Server and flag deviations in URI structure, payload size, or headers.
Monitoring Recommendations
- Monitor Oracle Fusion Middleware host processes for unexpected child processes or file writes outside standard content directories.
- Watch for outbound network traffic from WebCenter Content servers that indicates lateral movement into related Oracle products.
- Track privileged user sessions in Content Server for unusual activity following interaction with attacker-supplied content.
How to Mitigate CVE-2026-60640
Immediate Actions Required
- Apply the fixes published in the Oracle Security Alert July 2026 to affected 12.2.1.4.0 and 14.1.2.0.0 deployments.
- Inventory all Oracle WebCenter Content instances and confirm patch status against Oracle's advisory.
- Restrict network exposure of Content Server endpoints so that only trusted networks can reach the HTTP interface.
- Review recent administrative activity and audit logs for signs of exploitation prior to patching.
Patch Information
Oracle released the fix as part of the July 2026 Critical Patch Update. Administrators should follow the version-specific patch guidance in the Oracle Security Alert July 2026 for versions 12.2.1.4.0 and 14.1.2.0.0.
Workarounds
- Place the Content Server behind a reverse proxy or web application firewall that inspects and filters HTTP requests to vulnerable endpoints.
- Enforce authentication at the network perimeter for all Content Server access until patches are applied.
- Educate privileged users about the risk of interacting with untrusted content in WebCenter Content, since exploitation requires user interaction.
# Example: restrict Content Server HTTP access to trusted subnets via firewall
iptables -A INPUT -p tcp --dport 16200 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 16200 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
