CVE-2026-60934: Oracle WebCenter Content Auth Bypass Flaw

CVE-2026-60934 Overview

CVE-2026-60934 is an access control weakness [CWE-284] in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access over HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, and complete read access to all data accessible through Oracle WebCenter Content. The scope is changed, meaning attacks may impact additional products beyond WebCenter Content itself. Affected releases are Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0.

Critical Impact
Unauthenticated HTTP-based attackers can gain full read and write access to WebCenter Content data, with impact extending beyond the vulnerable component due to scope change.

Affected Products

Oracle WebCenter Content 12.2.1.4.0
Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware Content Server component

Discovery Timeline

2026-08-18 - CVE-2026-60934 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60934

Vulnerability Analysis

The vulnerability resides in the Content Server component of Oracle WebCenter Content. It is classified under [CWE-284] Improper Access Control. The flaw permits an unauthenticated actor to reach protected functionality over HTTP without credentials or user interaction. Exploitation is rated as high complexity, meaning the attacker must satisfy conditions outside their direct control, such as timing or configuration state. Once exploited, the attacker gains high confidentiality and integrity impact against WebCenter Content data. Because the vulnerability results in a scope change, attacks can affect resources beyond WebCenter Content itself, including downstream systems relying on stored content.

Root Cause

The root cause is improper access control within the Content Server. Requests that should require authentication or authorization checks are processed without them, exposing content management operations to anonymous callers over HTTP.

Attack Vector

The attack vector is network-based. An attacker sends crafted HTTP requests to a reachable Oracle WebCenter Content instance. No user interaction is required and no prior privileges are needed. Because complexity is high, exploitation likely depends on a specific server state or configuration precondition. See the Oracle Security Alert for vendor-provided technical context.

No public proof-of-concept code is available at this time. The EPSS probability is 0.318%, reflecting a low near-term exploitation forecast.

Detection Methods for CVE-2026-60934

Indicators of Compromise

Unauthenticated HTTP requests to Content Server endpoints such as /cs/idcplg returning successful responses without a valid session.
Anonymous creation, modification, or deletion events in WebCenter Content audit logs.
Unexpected content check-in, check-out, or metadata update operations attributed to system or anonymous users.

Detection Strategies

Baseline authenticated versus anonymous request ratios against Content Server and alert on deviations.
Correlate WebCenter Content audit events with upstream web server access logs to identify sessionless mutations.
Alert on HTTP requests targeting Content Server administrative service names (IdcService= parameters) from external or non-approved networks.

Monitoring Recommendations

Forward Oracle WebCenter Content and fronting web server logs to a centralized SIEM for correlation.
Monitor for spikes in HTTP POST requests to Content Server URIs originating from single source addresses.
Track integrity of content repositories and file stores using hash-based change detection.

How to Mitigate CVE-2026-60934

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert for Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0.
Restrict network exposure of Content Server to trusted management networks and reverse proxies enforcing authentication.
Review Content Server audit logs for unauthorized create, delete, or modify operations since the affected versions were deployed.

Patch Information

Oracle addresses this vulnerability in the August 2026 Critical Patch Update / Security Alert cycle. Administrators should download and apply the fix for their specific WebCenter Content release from the Oracle Security Alert advisory and follow Oracle's post-installation validation steps.

Workarounds

Place Oracle WebCenter Content behind a reverse proxy or web application firewall that enforces authentication on all Content Server URIs.
Block anonymous access to IdcService operations at the network edge until patches are applied.
Disable or firewall off internet-facing Content Server instances that do not require external reachability.

bash

# Example: restrict Content Server access at the reverse proxy (nginx)
location /cs/ {
    allow 10.0.0.0/8;
    deny all;
    auth_request /auth;
    proxy_pass http://webcenter-content-backend;
}