CVE-2026-60935 Overview
CVE-2026-60935 is a high-severity access control vulnerability [CWE-284] in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware. Affected versions include 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access over HTTP can compromise the product without user interaction. Exploitation is difficult but results in a scope change, meaning attacks can affect resources beyond the vulnerable component. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, plus unauthorized read access to all Oracle WebCenter Content accessible data.
Critical Impact
Unauthenticated network attackers can gain full read and write access to critical Oracle WebCenter Content data, with impact extending beyond the vulnerable component due to scope change.
Affected Products
- Oracle WebCenter Content 12.2.1.4.0
- Oracle WebCenter Content 14.1.2.0.0
- Oracle Fusion Middleware (Content Server component)
Discovery Timeline
- 2026-08-18 - CVE-2026-60935 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-60935
Vulnerability Analysis
The flaw resides in the Content Server component of Oracle WebCenter Content. It is classified as Improper Access Control [CWE-284]. Attackers reach the vulnerability over HTTP without authentication or user interaction. The exploit path is complex, requiring specific conditions or prior reconnaissance to succeed.
The vulnerability causes a scope change. This means a successful attack pivots from the vulnerable Content Server into adjacent Oracle products or shared resources. Confidentiality and integrity impacts are both rated high, while availability is not affected. Attackers can read, alter, or destroy any data accessible to the Content Server.
Root Cause
The root cause is improper enforcement of access control within the Content Server component. Restricted operations and data endpoints do not correctly validate the caller's authorization state. This allows an unauthenticated HTTP client to reach protected functionality that should require credentials.
Attack Vector
Exploitation is remote over HTTP. The attacker sends crafted HTTP requests to the Content Server without valid credentials. Because privileges required are none and user interaction is not needed, a single successful request chain can yield read or write access to WebCenter Content data stores. The scope change indicates that the compromised Content Server context can influence resources managed by other components. No verified public proof-of-concept is available at the time of publication.
No verified public exploit code exists. Refer to the Oracle Security Alert for vendor-provided technical detail.
Detection Methods for CVE-2026-60935
Indicators of Compromise
- Unauthenticated HTTP requests to Content Server endpoints that return authenticated content or successful write responses.
- Unexpected creation, modification, or deletion events in WebCenter Content audit logs originating from anonymous sessions.
- Anomalous outbound requests or data exfiltration patterns from hosts running Oracle WebCenter Content 12.2.1.4.0 or 14.1.2.0.0.
Detection Strategies
- Baseline normal Content Server traffic and alert on unauthenticated requests to administrative or document manipulation URIs.
- Correlate WebCenter Content audit logs with web server access logs to detect requests that produced privileged actions without a valid session cookie or token.
- Monitor for scope-change indicators such as unexpected access to adjacent Fusion Middleware services from the Content Server host.
Monitoring Recommendations
- Forward Oracle WebCenter Content audit logs, WebLogic access logs, and reverse-proxy logs to a centralized analytics platform for correlation.
- Enable verbose logging on Content Server document and metadata APIs to preserve forensic evidence.
- Track outbound network activity from Fusion Middleware hosts to detect lateral movement following exploitation.
How to Mitigate CVE-2026-60935
Immediate Actions Required
- Apply the fixes referenced in the Oracle Security Alert to all affected Oracle WebCenter Content deployments.
- Inventory Fusion Middleware environments to identify instances running 12.2.1.4.0 and 14.1.2.0.0.
- Restrict network reachability of the Content Server to trusted management networks until patches are deployed.
Patch Information
Oracle addressed CVE-2026-60935 in the August 2026 Critical Patch Update Security Alert. Administrators should download and apply the update packages listed in the Oracle Security Alert for versions 12.2.1.4.0 and 14.1.2.0.0. Validate patch deployment by verifying the Content Server build number after installation and running Oracle's post-patch verification steps.
Workarounds
- Place Oracle WebCenter Content behind a web application firewall configured to block unauthenticated requests to sensitive Content Server endpoints.
- Enforce network segmentation so that only authorized proxies or clients can reach the Content Server over HTTP or HTTPS.
- Disable or restrict any Content Server features that expose anonymous access if they are not required for business operations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
