CVE-2026-60655 Overview
CVE-2026-60655 is a high-severity vulnerability in Oracle WebCenter Content, a component of Oracle Fusion Middleware. The flaw resides in the Web Content Management component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise Oracle WebCenter Content. Successful exploitation results in a complete takeover of the application, with impacts to confidentiality, integrity, and availability. Oracle addressed the vulnerability in the July 2026 Critical Patch Update.
Critical Impact
Authenticated network attackers can achieve full takeover of Oracle WebCenter Content instances, compromising all data managed by the platform.
Affected Products
- Oracle WebCenter Content 12.2.1.4.0
- Oracle WebCenter Content 14.1.2.0.0
- Oracle Fusion Middleware (Web Content Management component)
Discovery Timeline
- 2026-07-21 - CVE CVE-2026-60655 published to NVD as part of the Oracle Critical Patch Update July 2026
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-60655
Vulnerability Analysis
CVE-2026-60655 affects the Web Content Management component of Oracle WebCenter Content. Oracle classifies the flaw as easily exploitable over the network via HTTP. An attacker requires only low-level authenticated access to trigger the vulnerability. Successful exploitation results in full takeover of the WebCenter Content instance, exposing managed documents, content repositories, and administrative functionality.
The scope remains unchanged, meaning exploitation impacts only the vulnerable component. However, because WebCenter Content is used to manage enterprise documents, records, and digital assets, a takeover exposes sensitive business data. The current EPSS score is 0.447%, placing the vulnerability in the 36th percentile of exploitation likelihood.
Root Cause
Oracle has not publicly disclosed the specific root cause. The advisory identifies the Web Content Management component as the affected subsystem. Vulnerabilities in this class of Oracle Fusion Middleware components have historically involved improper input validation, deserialization flaws, or broken access control in HTTP-facing endpoints.
Attack Vector
The attack vector is network-based over HTTP. An attacker must hold a low-privileged authenticated session against the WebCenter Content service. No user interaction is required. Once authenticated, the attacker sends crafted HTTP requests to the vulnerable endpoint. Successful requests grant control over the WebCenter Content application, impacting confidentiality, integrity, and availability. See the Oracle Critical Patch Update July 2026 advisory for technical context.
Detection Methods for CVE-2026-60655
Indicators of Compromise
- Unexpected administrative actions or new user accounts created within the Oracle WebCenter Content administration console.
- Anomalous HTTP requests targeting Web Content Management endpoints from low-privileged accounts.
- Unusual outbound connections or file operations originating from the WebCenter Content application server.
Detection Strategies
- Review WebCenter Content audit logs for privilege changes, content repository modifications, or configuration edits performed by non-administrative accounts.
- Correlate authentication events with subsequent HTTP requests to identify low-privileged sessions escalating capabilities.
- Monitor for exploitation attempts against known Oracle Fusion Middleware endpoints exposed to internal or external networks.
Monitoring Recommendations
- Enable verbose HTTP access logging on WebLogic servers hosting WebCenter Content and forward logs to a centralized SIEM.
- Track process execution and file system changes on WebCenter Content hosts to detect post-exploitation behavior.
- Alert on any WebCenter Content administrative API calls originating from unexpected source addresses.
How to Mitigate CVE-2026-60655
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to all Oracle WebCenter Content deployments running versions 12.2.1.4.0 and 14.1.2.0.0.
- Inventory all WebCenter Content instances, including those in development and test environments, to ensure complete patch coverage.
- Restrict network access to WebCenter Content HTTP endpoints to trusted management networks until patching is complete.
- Audit existing low-privileged accounts and rotate credentials for any accounts with WebCenter Content access.
Patch Information
Oracle released the fix as part of the Oracle Critical Patch Update July 2026. Administrators should download the patch bundle for their specific WebCenter Content version and apply it using the standard Oracle OPatch process. Verify successful deployment by checking inventory metadata and confirming build numbers after restart.
Workarounds
- Place WebCenter Content behind a web application firewall configured to filter suspicious HTTP requests against Web Content Management endpoints.
- Enforce strict least-privilege on all WebCenter Content accounts and remove unused user accounts.
- Segment WebCenter Content servers on isolated network zones with strict ingress filtering until patches are applied.
# Verify installed Oracle WebCenter Content patches using OPatch
cd $ORACLE_HOME/OPatch
./opatch lsinventory | grep -i "WebCenter Content"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
