CVE-2026-60909: Oracle WebCenter Content Auth Bypass Flaw

CVE-2026-60909 Overview

CVE-2026-60909 is a high-severity access control vulnerability [CWE-284] in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware. Affected supported releases are 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access over HTTP can exploit the flaw, but successful exploitation requires user interaction from a victim other than the attacker. The scope change means an attack against Oracle WebCenter Content can impact additional downstream products. Successful exploitation results in unauthorized read access to all WebCenter Content data, and partial unauthorized update, insert, or delete access.

Critical Impact
Authenticated network attackers can trick a legitimate user into triggering a request that yields full read access to Oracle WebCenter Content data and partial write access, with scope change to adjacent products.

Affected Products

Oracle WebCenter Content 12.2.1.4.0
Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware (Content Server component)

Discovery Timeline

2026-08-18 - CVE-2026-60909 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60909

Vulnerability Analysis

CVE-2026-60909 resides in the Content Server component of Oracle WebCenter Content. The flaw is classified as Improper Access Control [CWE-284]. An authenticated attacker holding only low privileges can send crafted HTTP requests to the Content Server and, when a separate victim user interacts with attacker-supplied content, the attacker obtains unauthorized access to data stored in and served through WebCenter Content.

The vulnerability produces a scope change, meaning the compromised authorization boundary extends beyond WebCenter Content into other products that consume or trust it. Impact on confidentiality is high, with unauthorized read access to all accessible data. Integrity impact is limited but non-trivial, allowing modification of a subset of data.

Root Cause

The root cause is improper enforcement of access controls in the Content Server request handling logic. Oracle has not published low-level technical detail, but the CWE-284 classification and the user-interaction requirement are consistent with a flaw where privilege or ownership checks are missing or insufficient when processing HTTP requests that reference protected content on behalf of another authenticated session.

Attack Vector

The attack vector is network-based over HTTP. An attacker authenticates with low privileges, then crafts a request or link that, when accessed by another authenticated user, causes the Content Server to disclose or modify data the attacker should not reach. The victim interaction requirement makes phishing, malicious internal links, or embedded content in shared workspaces plausible delivery paths. Refer to the Oracle Security Alert for vendor guidance.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data places exploitation probability at a low baseline as of the disclosure date.

Detection Methods for CVE-2026-60909

Indicators of Compromise

Unexpected HTTP requests to Content Server endpoints originating from low-privileged accounts and referencing content owned by higher-privileged users.
Access log entries showing successful retrieval or modification of documents by user sessions that do not match the document's ACL or ownership metadata.
Anomalous cross-user activity where one authenticated user's browser session triggers content retrieval that benefits a different account.

Detection Strategies

Correlate Oracle WebCenter Content audit logs with web server access logs to identify requests that cross authorization boundaries after user interaction events such as link clicks.
Baseline normal document access patterns per role and alert on outliers, particularly bulk reads or edits performed by low-privileged accounts.
Deploy web application firewall rules that inspect Content Server request parameters for references to document IDs outside the requesting user's authorized scope.

Monitoring Recommendations

Enable verbose auditing on the Content Server for authentication, authorization decisions, and document access operations.
Forward Fusion Middleware and WebCenter Content logs to a centralized analytics platform for retention and cross-source correlation.
Monitor outbound email and collaboration channels for suspicious links pointing at internal Content Server URLs that could be used to trigger victim interaction.

How to Mitigate CVE-2026-60909

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 deployments.
Inventory all Oracle Fusion Middleware installations and confirm which instances run the affected Content Server component.
Restrict network access to Content Server HTTP endpoints so only trusted networks and authenticated users can reach them.
Review recent audit logs for signs of cross-user data access consistent with the vulnerability pattern.

Patch Information

Oracle addressed CVE-2026-60909 in the security alert published for Oracle WebCenter Content. Administrators should consult the Oracle Security Alert for the exact patch identifiers matching versions 12.2.1.4.0 and 14.1.2.0.0, and apply them through the standard Oracle patching workflow. No supported workaround fully substitutes for the vendor patch.

Workarounds

Reduce the population of low-privileged accounts with any access to Content Server until patching is complete.
Enforce user awareness controls around clicking links to internal WebCenter Content URLs received from untrusted or unexpected sources.
Place Content Server behind a reverse proxy or WAF that requires strong authentication and inspects requests for suspicious cross-user references.

bash

# Configuration example
# Refer to the Oracle Security Alert for authoritative patch identifiers
# https://www.oracle.com/security-alerts/cspuaug2026.html