CVE-2026-60643 Overview
CVE-2026-60643 is a high-severity vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware, specifically within the Content Server component. Affected supported versions are 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can exploit the flaw, provided a separate user performs a required interaction. Successful exploitation results in full takeover of Oracle WebCenter Content, impacting confidentiality, integrity, and availability. Oracle addressed this issue in the July 2026 Critical Patch Update.
Critical Impact
Successful exploitation allows a low-privileged attacker to fully take over Oracle WebCenter Content, compromising all stored enterprise content and workflows.
Affected Products
- Oracle WebCenter Content 12.2.1.4.0
- Oracle WebCenter Content 14.1.2.0.0
- Oracle Fusion Middleware — Content Server component
Discovery Timeline
- 2026-07-21 - CVE CVE-2026-60643 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Oracle releases fix in the Oracle Security Alert July 2026
Technical Details for CVE-2026-60643
Vulnerability Analysis
The vulnerability resides in the Content Server component of Oracle WebCenter Content, the enterprise content management module of Oracle Fusion Middleware. An authenticated attacker with only low privileges can send crafted HTTP requests to the Content Server. Exploitation requires interaction from a separate user, indicating an attack pattern consistent with client-side triggered flaws such as stored cross-site scripting or a request-forgery style condition that leverages a privileged user's session.
Once triggered, the attacker gains complete control over the WebCenter Content instance. This includes access to managed documents, workflows, and administrative functions. The scope is unchanged, meaning the compromise remains within the vulnerable component but affects all data it manages. The EPSS score of 0.359% reflects a currently low predicted exploitation probability, but authenticated Oracle Fusion Middleware deployments remain high-value targets.
Root Cause
Oracle has not published the underlying weakness class, and no CWE identifier is assigned in the NVD entry. The requirement for authentication combined with user interaction suggests improper input handling on a Content Server endpoint that is later rendered or processed in a privileged context. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical detail.
Attack Vector
The attack vector is network-based over HTTP. An attacker first obtains low-level authenticated access to the WebCenter Content instance. The attacker then submits crafted content or requests that later trigger malicious execution when a second user, typically one with higher privileges, interacts with the affected resource. This interaction chain converts limited access into full takeover of the Content Server.
No verified public proof-of-concept code is available at the time of publication. The vulnerability should be described in prose only; readers requiring exploitation specifics should consult the Oracle advisory when access is granted.
Detection Methods for CVE-2026-60643
Indicators of Compromise
- Unexpected creation or modification of content items by low-privileged accounts in WebCenter Content audit logs.
- HTTP requests to Content Server endpoints containing unusual payload structures, encoded scripts, or unexpected metadata fields.
- Administrative or workflow actions executed in sessions belonging to users who did not initiate them.
Detection Strategies
- Enable and review WebCenter Content Server audit logging for privilege changes, role assignments, and configuration edits following low-privileged user activity.
- Correlate authentication events with subsequent high-impact administrative operations to identify session-based abuse.
- Deploy web application firewall rules to inspect HTTP traffic to /cs/ and related Content Server URIs for anomalous payloads.
Monitoring Recommendations
- Forward Fusion Middleware and Content Server logs to a centralized SIEM for retention and correlation.
- Alert on any modification of security groups, roles, or workflow definitions performed by non-administrative accounts.
- Monitor outbound network connections from the WebCenter Content host for unusual destinations that may indicate post-exploitation activity.
How to Mitigate CVE-2026-60643
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all affected WebCenter Content deployments without delay.
- Inventory all Oracle Fusion Middleware instances and confirm versions 12.2.1.4.0 and 14.1.2.0.0 are patched.
- Review WebCenter Content user accounts and remove or disable dormant low-privileged accounts that could serve as attacker footholds.
- Audit privileged user activity for the period preceding patch deployment to identify potential prior exploitation.
Patch Information
Oracle released a fix in the Oracle Security Alert July 2026. Administrators must download and apply the corresponding patch for their WebCenter Content version through the standard Oracle patching process. Follow the vendor's pre-installation and post-installation validation steps to confirm the update was applied successfully.
Workarounds
- Restrict network access to the WebCenter Content Server so that only trusted internal networks can reach HTTP endpoints.
- Enforce least-privilege access and reduce the number of accounts with content creation or editing rights until patching is complete.
- Advise administrators and privileged users to avoid interacting with content submitted by untrusted or low-privileged accounts until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
