CVE-2026-60905: Oracle WebCenter Content Auth Bypass Flaw

CVE-2026-60905 Overview

CVE-2026-60905 is a critical vulnerability in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise the product when a user performs an action initiated by the attacker. The flaw carries a scope change, meaning exploitation can impact systems beyond Oracle WebCenter Content. Successful attacks lead to unauthorized creation, modification, or deletion of data, unauthorized read access to all accessible data, and partial denial of service. Oracle categorizes the issue under [CWE-284: Improper Access Control].

Critical Impact
Unauthenticated network-based exploitation combined with a scope change permits full read/write access to Oracle WebCenter Content data and can extend impact to adjacent products.

Affected Products

Oracle WebCenter Content 12.2.1.4.0
Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware deployments hosting the affected Content Server component

Discovery Timeline

2026-08-18 - CVE-2026-60905 published to NVD
2026-08-20 - Last updated in NVD database
2026-08-20 - EPSS score published at 0.36% (percentile 29.27)

Technical Details for CVE-2026-60905

Vulnerability Analysis

The vulnerability resides in the Content Server component of Oracle WebCenter Content. Oracle classifies the flaw as improper access control [CWE-284]. Exploitation is initiated over HTTP and does not require authentication, but it does require an authenticated victim to perform an action requested by the attacker. This user-interaction requirement typically maps to phishing, link-baiting, or malicious content embedded in trusted channels.

A scope change amplifies the risk. Impact extends beyond the vulnerable Content Server to other Oracle products that share trust boundaries or session context. Confidentiality and integrity impacts are high, while availability impact is partial. Attackers can read, modify, or delete every asset accessible to the compromised session and disrupt service through resource abuse.

Root Cause

The root cause is improper access control within request handling of the Content Server. The component fails to sufficiently validate the origin, authorization, or intent of an incoming HTTP action before performing privileged content operations. Oracle has not published low-level technical detail beyond the security alert.

Attack Vector

Exploitation proceeds over the network via HTTP against a reachable Oracle WebCenter Content instance. The attacker crafts a request or link that, once triggered by an authenticated user, executes content-management operations under the victim's context. See the Oracle Security Alert for the vendor advisory.

No verified public exploit code or proof-of-concept is available. The vulnerability mechanism is described in prose because no sanitized exploit reference has been released.

Detection Methods for CVE-2026-60905

Indicators of Compromise

Unexpected content check-in, check-out, deletion, or metadata modification events in Content Server audit logs attributed to legitimate users.
HTTP requests to Content Server endpoints originating from cross-origin referrers or embedded within email links.
Bursts of Content Server API activity following user clicks on external URLs.

Detection Strategies

Correlate web access logs with Content Server audit trails to surface actions performed immediately after cross-site navigation events.
Alert on privileged content operations (delete, permission change, mass export) executed within seconds of a user session initiation.
Baseline normal HTTP verb and endpoint usage per user role and flag deviations against the Content Server administrative URIs.

Monitoring Recommendations

Enable verbose HTTP and audit logging on all Oracle WebCenter Content nodes and forward events to a centralized analytics platform.
Monitor egress from Content Server hosts for unexpected data transfers indicative of scope-changed data exfiltration.
Track failed and successful authentication anomalies on integrated Oracle Fusion Middleware products that share trust with the Content Server.

How to Mitigate CVE-2026-60905

Immediate Actions Required

Apply the patch published in the Oracle Security Alert cspuaug2026 to all affected Oracle WebCenter Content deployments.
Inventory all instances of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 and prioritize internet-exposed systems.
Restrict inbound HTTP access to Content Server to authenticated corporate networks or VPN segments until patches are verified.

Patch Information

Oracle addressed CVE-2026-60905 through a security alert update. Administrators should reference the Oracle Security Alert for exact patch identifiers, prerequisite bundle patches, and post-installation validation steps. Apply the update in a staged environment before rolling to production and reset any credentials or tokens issued during the exposure window.

Workarounds

Enforce strict Referer and Origin header validation at the reverse proxy in front of Content Server to blunt cross-site action delivery.
Deploy a web application firewall rule set that inspects and blocks unexpected state-changing HTTP requests targeting Content Server endpoints.
Require re-authentication or step-up authentication for sensitive content operations while patch rollout is in progress.

bash

# Example reverse-proxy hardening (illustrative)
# Block state-changing methods without a same-origin Referer
location /cs/ {
    if ($request_method ~ ^(POST|PUT|DELETE)$) {
        if ($http_referer !~* "^https://webcenter\.example\.com/") {
            return 403;
        }
    }
    proxy_pass http://webcenter_upstream;
}