CVE-2026-60663: Oracle WebCenter Content RCE Vulnerability

CVE-2026-60663 Overview

CVE-2026-60663 is a critical vulnerability in Oracle WebCenter Content, a component of Oracle Fusion Middleware. The flaw resides in the Web Content Management component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can exploit the issue without user interaction. Successful exploitation results in complete takeover of Oracle WebCenter Content. The vulnerability carries a scope change, meaning attacks can significantly impact additional products beyond WebCenter Content itself.

Critical Impact
Low-privileged network attackers can achieve full compromise of Oracle WebCenter Content with cross-product impact, leading to loss of confidentiality, integrity, and availability.

Affected Products

Oracle WebCenter Content 12.2.1.4.0
Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware (Web Content Management component)

Discovery Timeline

2026-07-21 - CVE-2026-60663 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in Oracle Security Alert July 2026

Technical Details for CVE-2026-60663

Vulnerability Analysis

Oracle WebCenter Content is an enterprise content management platform used to store, manage, and deliver unstructured content. The vulnerability sits in the Web Content Management component and is described by Oracle as easily exploitable over HTTP. An authenticated attacker holding only low privileges can trigger the flaw remotely without any user interaction.

The issue carries a scope change, which indicates that the vulnerable component can influence resources outside its own security authority. Exploitation compromises confidentiality, integrity, and availability, and Oracle explicitly states attacks can result in takeover of the product. The EPSS probability is currently 0.328% with a percentile of 25.178, indicating limited public exploitation activity at the time of publication.

Root Cause

Oracle has not published root-cause details in the public advisory. The vendor bulletin classifies the flaw within the Web Content Management subcomponent and confirms the scope change behavior, which typically points to improper authorization or unsafe handling of privileged operations across trust boundaries. Refer to the Oracle Security Alert July 2026 for authoritative technical detail.

Attack Vector

The attack vector is network based over HTTP. The attacker must hold valid low-privileged credentials on the WebCenter Content instance. No user interaction is required. Because the vulnerability crosses a security scope, successful exploitation can pivot into adjacent Fusion Middleware products and any downstream systems that trust the WebCenter Content service account.

No verified proof-of-concept code is publicly available. See the vendor advisory for authoritative technical details.

Detection Methods for CVE-2026-60663

Indicators of Compromise

Unexpected HTTP POST requests to Oracle WebCenter Content Web Content Management endpoints originating from low-privileged accounts.
Creation of new administrator accounts, service credentials, or unexpected content items within WebCenter Content repositories.
Outbound network connections from the WebCenter Content host to unfamiliar external destinations following authenticated HTTP activity.
Access to Fusion Middleware components by identities that normally interact only with WebCenter Content, indicating scope-change exploitation.

Detection Strategies

Enable and centrally forward WebCenter Content access logs and Fusion Middleware audit logs for behavioral analysis.
Baseline typical HTTP request patterns per user role and alert on low-privileged sessions issuing administrative or content-management calls.
Correlate authentication events with subsequent privilege changes, deployment actions, or file writes on the WebCenter host.
Monitor for process launches spawned by the WebLogic or WebCenter Content JVM that are not part of standard operations.

Monitoring Recommendations

Ingest WebCenter Content, WebLogic, and OS logs into a centralized platform such as Singularity Data Lake for correlation and long-term retention.
Alert on any modification of WebCenter Content configuration files and administrative role assignments.
Track egress network traffic from Fusion Middleware hosts and flag anomalous destinations or data volumes.

How to Mitigate CVE-2026-60663

Immediate Actions Required

Apply the fixes distributed in the Oracle July 2026 Critical Patch Update to all Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 deployments.
Inventory all Fusion Middleware instances exposed to internal or external HTTP traffic and prioritize patching internet-facing systems.
Rotate credentials for low-privileged WebCenter Content accounts, particularly those with broad reachability across the environment.
Review recent audit logs for suspicious authenticated activity dating back to before the patch was applied.

Patch Information

Oracle addressed CVE-2026-60663 in the Oracle Security Alert July 2026. Administrators should download the Critical Patch Update relevant to their WebCenter Content release and follow Oracle's documented deployment procedure. No official workaround from Oracle is currently published; patching is the authoritative remediation.

Workarounds

Restrict HTTP access to WebCenter Content administrative and Web Content Management endpoints using network ACLs, reverse proxy rules, or a web application firewall until patches are deployed.
Enforce strong authentication and reduce the number of accounts granted any privilege on WebCenter Content, following least-privilege principles.
Segment WebCenter Content hosts from adjacent Fusion Middleware and back-end systems to limit the impact of scope-change exploitation.

bash

# Example: restrict WebCenter Content HTTP access at the network edge
# Replace addresses with your trusted management ranges
iptables -A INPUT -p tcp --dport 16200 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 16200 -j DROP