CVE-2026-60649 Overview
CVE-2026-60649 is a critical vulnerability in Oracle WebCenter Content, part of Oracle Fusion Middleware. The flaw resides in the Web Content Management component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle WebCenter Content without user interaction. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all WebCenter Content accessible data. Oracle addressed the issue in the Oracle Security Alert July 2026.
Critical Impact
Remote unauthenticated attackers can read, modify, or delete all data accessible to Oracle WebCenter Content over HTTP.
Affected Products
- Oracle WebCenter Content 12.2.1.4.0
- Oracle WebCenter Content 14.1.2.0.0
- Oracle Fusion Middleware (Web Content Management component)
Discovery Timeline
- 2026-07-21 - CVE-2026-60649 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Oracle publishes security alert with patch guidance
Technical Details for CVE-2026-60649
Vulnerability Analysis
The vulnerability affects the Web Content Management component of Oracle WebCenter Content, a document and content management platform used across enterprise Fusion Middleware deployments. The flaw is reachable over HTTP by an unauthenticated attacker and requires no privileges or user interaction. Exploitation grants both confidentiality and integrity impact at the highest CVSS levels, meaning attackers can read and alter all content the WebCenter instance manages.
Oracle categorizes the issue as easily exploitable. Because WebCenter Content typically stores regulated business documents, contracts, and structured records, compromise carries direct data integrity and disclosure risk for the hosting organization.
Root Cause
Oracle has not published a technical breakdown of the underlying defect. Based on Oracle's advisory language, the flaw allows the Web Content Management component to accept and process attacker-supplied HTTP requests without enforcing authentication or authorization on operations that create, modify, delete, or read content. Additional technical details are available in the Oracle Security Alert July 2026.
Attack Vector
The attack vector is network-based over HTTP. An attacker sends crafted requests directly to an internet-reachable or internally reachable Oracle WebCenter Content endpoint. No credentials, tokens, or victim interaction are required. Once the request is processed, the attacker gains the ability to enumerate stored content, exfiltrate documents, or tamper with managed records.
No public proof-of-concept exploit code has been verified at the time of publication. The EPSS score is 0.398% (32.34 percentile), indicating limited observed exploitation activity so far.
Detection Methods for CVE-2026-60649
Indicators of Compromise
- Unauthenticated HTTP requests to Oracle WebCenter Content endpoints originating from unexpected external IP ranges.
- Unexpected content creation, modification, or deletion events in WebCenter audit logs without a corresponding authenticated user session.
- Anomalous bulk read operations against the Content Server document repository.
- Outbound data transfers from the WebCenter Content host that do not align with normal integration traffic.
Detection Strategies
- Review Oracle WebCenter Content access and audit logs for content operations performed without valid session context.
- Correlate web server logs with application-layer audit trails to identify HTTP requests that produced content mutations without prior authentication.
- Baseline typical Web Content Management API traffic and alert on deviations in request volume, source geography, or user-agent patterns.
Monitoring Recommendations
- Forward WebCenter Content, WebLogic, and reverse proxy logs to a centralized SIEM for correlation across the stack.
- Enable full HTTP request logging on any load balancer or WAF fronting WebCenter Content until patching completes.
- Monitor file system and database changes on the Content Server for unexpected modifications to managed content.
How to Mitigate CVE-2026-60649
Immediate Actions Required
- Apply the Oracle Critical Patch Update from the Oracle Security Alert July 2026 to all affected WebCenter Content instances.
- Inventory all Oracle WebCenter Content deployments running 12.2.1.4.0 or 14.1.2.0.0 and prioritize internet-exposed systems.
- Restrict network access to WebCenter Content management endpoints to trusted administrative networks until patches are deployed.
- Review WebCenter audit and access logs from the last 90 days for signs of unauthenticated content operations.
Patch Information
Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Security Alert July 2026 to identify the correct patch level for versions 12.2.1.4.0 and 14.1.2.0.0, then apply the update through standard Oracle Fusion Middleware patching procedures.
Workarounds
- Place a web application firewall in front of WebCenter Content and block unauthenticated requests to Web Content Management endpoints.
- Remove direct internet exposure of WebCenter Content by routing access through an authenticated reverse proxy or VPN.
- Enforce strict IP allowlisting on the WebLogic managed servers hosting WebCenter Content until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
