CVE-2026-60647: Oracle WebCenter Content Auth Bypass Flaw

CVE-2026-60647 Overview

CVE-2026-60647 is a high-severity vulnerability in Oracle WebCenter Content, a component of Oracle Fusion Middleware. The flaw resides in the Web Content Management component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can exploit this vulnerability without user interaction. Successful exploitation leads to unauthorized access to critical data managed by Oracle WebCenter Content and can cause a partial denial of service. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers can gain complete access to all data accessible through Oracle WebCenter Content and degrade service availability over the network.

Affected Products

Oracle WebCenter Content 12.2.1.4.0
Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware — Web Content Management component

Discovery Timeline

2026-07-21 - CVE-2026-60647 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in Oracle Security Advisory July 2026

Technical Details for CVE-2026-60647

Vulnerability Analysis

The vulnerability affects the Web Content Management component of Oracle WebCenter Content. An authenticated attacker with low privileges can send crafted HTTP requests to the WebCenter Content interface. The attack requires no user interaction and low attack complexity. Successful exploitation results in high impact to confidentiality and low impact to availability, while integrity remains unaffected. The current EPSS probability is 0.38%, placing it in approximately the 30th percentile for observed exploitation likelihood.

Root Cause

Oracle has not published detailed root cause information in the public advisory. The issue involves improper access control within the Web Content Management component that permits a low-privileged user to reach data and functions outside their authorization scope. Refer to the Oracle Security Advisory July 2026 for vendor-supplied technical context.

Attack Vector

The attack vector is network-based over HTTP. An attacker must hold valid low-privileged credentials for the WebCenter Content instance. The attacker sends HTTP requests targeting the Web Content Management interface to retrieve sensitive content or disrupt content operations. No user interaction is required, and the scope remains unchanged, meaning exploitation stays within the vulnerable component.

No verified public proof-of-concept code is available for CVE-2026-60647. Organizations should treat any exposed WebCenter Content interface as a high-value target for authenticated exploitation attempts.

Detection Methods for CVE-2026-60647

Indicators of Compromise

Unexpected HTTP requests from low-privileged accounts targeting Oracle WebCenter Content Web Content Management endpoints.
Abnormal volumes of content retrieval or search requests from a single authenticated session.
Application or service errors in WebCenter Content logs consistent with malformed or unauthorized requests.
Access to content items or metadata inconsistent with the acting user's role assignments.

Detection Strategies

Correlate WebCenter Content access logs with identity provider logs to identify low-privileged accounts accessing high-sensitivity content.
Deploy web application firewall rules to inspect HTTP traffic to WebCenter Content endpoints for anomalous parameters and request patterns.
Baseline normal user behavior in WebCenter Content and alert on deviations, particularly bulk content access by non-administrative accounts.

Monitoring Recommendations

Enable and centralize WebCenter Content audit logging, including document access, search, and administrative actions.
Forward Oracle Fusion Middleware logs to a SIEM for retention and correlation with authentication events.
Monitor availability metrics for WebCenter Content services to identify partial denial-of-service conditions.

How to Mitigate CVE-2026-60647

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for affected Oracle WebCenter Content deployments as soon as maintenance windows permit.
Inventory all Oracle Fusion Middleware instances and confirm which run WebCenter Content 12.2.1.4.0 or 14.1.2.0.0.
Restrict network access to WebCenter Content administrative and content interfaces to trusted networks only.
Review and reduce standing low-privileged accounts that can authenticate to WebCenter Content.

Patch Information

Oracle addressed CVE-2026-60647 in the July 2026 Critical Patch Update. Administrators should review the Oracle Security Advisory July 2026 for the applicable patch bundles and installation instructions for Oracle Fusion Middleware.

Workarounds

Place WebCenter Content behind a reverse proxy or WAF that enforces authentication policies and rate limits per session.
Enforce network segmentation so WebCenter Content is not reachable from untrusted networks or user workstations without VPN.
Rotate credentials for low-privileged WebCenter Content accounts and enforce multi-factor authentication where supported.
Increase audit logging verbosity for the Web Content Management component until patches are deployed.

bash

# Example: restrict access to WebCenter Content ports at the host firewall
# Allow only trusted management subnet 10.10.20.0/24 to reach WebCenter Content on port 16200
iptables -A INPUT -p tcp --dport 16200 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 16200 -j DROP