CVE-2026-60651: Oracle WebCenter Content Auth Bypass Flaw

CVE-2026-60651 Overview

CVE-2026-60651 is a high-severity vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware, specifically within the Web Content Management component. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can exploit the issue, though successful exploitation requires human interaction from a user other than the attacker. Successful attacks result in full takeover of Oracle WebCenter Content, compromising confidentiality, integrity, and availability.

Critical Impact
Unauthenticated network attackers can achieve complete takeover of Oracle WebCenter Content instances when a targeted user interacts with an attacker-supplied vector, exposing managed enterprise content and administrative functions.

Affected Products

Oracle WebCenter Content 12.2.1.4.0
Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware — Web Content Management component

Discovery Timeline

2026-07-21 - CVE-2026-60651 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-60651

Vulnerability Analysis

The vulnerability resides in the Web Content Management component of Oracle WebCenter Content, a platform used to manage enterprise documents, digital assets, and web content. The issue is remotely exploitable over HTTP without authentication, and Oracle classifies it as easily exploitable. Because successful attacks yield takeover of the WebCenter Content instance, an adversary can read, modify, and destroy managed content, alter site publishing workflows, and pivot to connected Fusion Middleware services.

The user interaction requirement indicates that a victim other than the attacker must perform an action, such as visiting a crafted URL or opening attacker-supplied content processed by the server. This behavior is consistent with client-mediated vectors that reach server-side content handling logic in WebCenter Content. The EPSS probability sits at 0.314% (23.7th percentile) as of 2026-07-23, indicating limited observed exploitation attempts at publication.

Root Cause

Oracle has not published a detailed root cause. The advisory metadata points to the Web Content Management component of Oracle WebCenter Content as the affected surface. The combination of network attack vector, no privileges required, and required user interaction is typical of server-side processing flaws triggered through user-driven request flows in WebCenter Content endpoints.

Attack Vector

The attacker delivers a crafted HTTP request or link to a user with access to the WebCenter Content environment. When the user interacts with the payload, the server processes attacker-controlled input in a way that leads to takeover of the WebCenter Content instance. No authentication or elevated privileges are required on the attacker's side, and the impact spans confidentiality, integrity, and availability.

No verified public proof-of-concept or exploit code is available at this time. Refer to the Oracle Critical Patch Update July 2026 for the official technical guidance.

Detection Methods for CVE-2026-60651

Indicators of Compromise

Unexpected administrative or content-management actions performed by standard WebCenter Content user accounts.
New or modified content items, templates, or workflows created without a corresponding change ticket.
Anomalous HTTP requests to Web Content Management endpoints containing encoded payloads or unusual referrers.
Outbound connections from the WebCenter Content host to unfamiliar external infrastructure following user interaction with external links.

Detection Strategies

Inspect WebCenter Content access and audit logs for POST requests to Web Content Management handlers immediately preceded by user interaction events.
Correlate authenticated session activity with unusual privilege operations or bulk content modifications.
Monitor Fusion Middleware server processes for spawning of shells, script interpreters, or java subprocesses without an operational trigger.

Monitoring Recommendations

Enable full request logging on WebCenter Content HTTP listeners and forward logs to a centralized SIEM for retention and analysis.
Alert on first-seen user agents or referrers touching Web Content Management URLs, especially those preceding privileged actions.
Baseline normal content editor and administrator behavior, and flag deviations such as off-hours publishing or mass edits.

How to Mitigate CVE-2026-60651

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update July 2026 to all Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 deployments.
Inventory internet-exposed WebCenter Content instances and restrict access to trusted networks until patching is complete.
Rotate credentials, API tokens, and integration secrets used by WebCenter Content if compromise is suspected.
Brief content authors and administrators on the user-interaction requirement and warn against clicking untrusted links referencing WebCenter Content URLs.

Patch Information

Oracle addresses this vulnerability in the July 2026 Critical Patch Update. Administrators must download and apply the patch bundle applicable to their WebCenter Content release. Verify the installation using Oracle's post-installation validation procedures and confirm the patched build number matches the CPU advisory.

Workarounds

Place WebCenter Content behind a web application firewall (WAF) with rules that inspect and constrain requests to Web Content Management endpoints.
Enforce network segmentation so that WebCenter Content is reachable only from authorized user networks and jump hosts.
Disable or restrict unused Web Content Management features and public-facing content delivery paths where feasible until patches are applied.
Require multi-factor authentication for all WebCenter Content administrator and editor accounts to limit downstream impact from a compromised session.