CVE-2026-60954: Oracle WebCenter Content Auth Bypass Issue

CVE-2026-60954 Overview

CVE-2026-60954 is a high-severity vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware, specifically within the Content Server component. The flaw allows an unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Oracle WebCenter Content accessible data. The vulnerability carries a scope change, meaning attacks may significantly impact additional products beyond WebCenter Content itself. Affected supported versions are 12.2.1.4.0 and 14.1.2.0.0. The weakness maps to [CWE-284] Improper Access Control.

Critical Impact
Unauthenticated network attackers can read, modify, or destroy all data accessible to Oracle WebCenter Content, with impact extending beyond the affected component due to scope change.

Affected Products

Oracle WebCenter Content 12.2.1.4.0
Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware (Content Server component)

Discovery Timeline

2026-08-18 - CVE CVE-2026-60954 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60954

Vulnerability Analysis

The vulnerability resides in the Content Server component of Oracle WebCenter Content. An unauthenticated attacker reaches the vulnerable code path over HTTP without any user interaction. Exploitation is rated difficult, but successful attacks yield high confidentiality and high integrity impact. The scope change indicates that a compromise of the vulnerable component grants the attacker influence over resources managed by other security authorities. This behavior is consistent with access control weaknesses that permit an attacker to traverse trust boundaries between Fusion Middleware subsystems. The Exploit Prediction Scoring System (EPSS) currently ranks exploitation likelihood at a moderate percentile among published CVEs.

Root Cause

The root cause is Improper Access Control ([CWE-284]) within the Content Server request handling logic. The component fails to enforce sufficient authorization checks on specific HTTP-accessible operations, allowing anonymous requests to reach privileged content management functions. Because the Content Server brokers access to documents and metadata that other Fusion Middleware components consume, the missing checks propagate authority outside the immediate trust boundary.

Attack Vector

The attack vector is network-based over HTTP. The attacker requires no valid credentials and no user interaction. Attack complexity is high, indicating that the attacker must satisfy conditions outside their direct control, such as specific configuration state, timing, or knowledge of internal identifiers. Once those conditions are met, the attacker issues crafted HTTP requests to the Content Server to read, create, modify, or delete content and metadata.

No verified public proof-of-concept code is available. See the Oracle Security Alert for vendor-supplied technical details.

Detection Methods for CVE-2026-60954

Indicators of Compromise

Anonymous or unauthenticated HTTP requests to Content Server administrative or content-management endpoints originating from external addresses.
Unexpected creation, modification, or deletion of documents, folders, or metadata within Oracle WebCenter Content audit logs.
HTTP responses returning content to sessions that never completed authentication against the Content Server.

Detection Strategies

Correlate WebCenter Content access logs with authentication logs to surface requests that access content without a preceding successful login event.
Baseline typical Content Server request patterns and alert on bursts of write operations from single source addresses.
Inspect reverse proxy or WAF logs for requests targeting /cs/, IdcService= parameters, or other Content Server URIs from untrusted networks.

Monitoring Recommendations

Enable verbose Content Server auditing for create, update, delete, and check-in/check-out operations.
Forward Fusion Middleware logs to a centralized SIEM for cross-component correlation with downstream systems affected by the scope change.
Monitor egress from WebCenter Content hosts for unusual outbound data flows that may indicate bulk content exfiltration.

How to Mitigate CVE-2026-60954

Immediate Actions Required

Apply the fixes distributed in the Oracle Security Alert referenced below to all instances running Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0.
Restrict network exposure of Content Server endpoints so that only authenticated internal users and trusted integrations can reach them.
Review WebCenter Content audit logs for anomalous unauthenticated activity since the vulnerability disclosure.

Patch Information

Oracle published fixes for CVE-2026-60954 as part of its August 2026 security alert cycle. Consult the Oracle Security Alert for patch identifiers, prerequisite bundle patches, and application instructions specific to each affected version. Apply the patches during the next available maintenance window and verify post-patch functionality against the Content Server component.

Workarounds

Place Content Server behind a reverse proxy or web application firewall that enforces authentication before requests reach the application tier.
Block external access to Content Server management URIs at the network perimeter until patches are applied.
Reduce the privileges granted to service accounts that WebCenter Content uses to interact with downstream Fusion Middleware components, limiting the blast radius of a scope-change exploit.

bash

# Example: restrict Content Server access at the reverse proxy layer
# (Apache HTTP Server sample - adapt to your environment)
<Location "/cs/">
    Require ip 10.0.0.0/8
    Require valid-user
    AuthType Basic
    AuthName "WebCenter Content"
</Location>