Oracle WebCenter Content CVE-2026-60335

Exploitation requires the attacker to already hold a high-privilege account on Oracle WebCenter Content (CVSS PR:H) and network HTTP access to the Content Server component of an affected instance (12.2.1.4.0 or 14.1.2.0.0). The attack is network-based (AV:N), low-complexity (AC:L), and needs no user interaction (UI:N), so no victim action or special client-side condition is needed. The primary limiting factor is the high-privilege requirement - this is not exploitable by anonymous or low-privileged users against a default configuration, which substantially narrows the realistic attacker set to those with, or able to obtain, administrative-level access. No specific non-default feature toggle is named in the description beyond the presence of the Content Server component itself.

The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) shows a network-reachable, low-complexity attack requiring no user interaction but demanding high privileges (PR:H) - the privilege requirement is the single largest mitigating factor and is why the score lands at 7.2 rather than in the critical range. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. There is no SSVC decision data supplied. The practical risk is therefore moderate and gated on an attacker already possessing administrative/high-privilege access to the Content Server, which shifts the realistic threat model toward insider abuse, compromised admin credentials, or privilege chaining rather than opportunistic mass exploitation. Note the tension between the 'Information Disclosure' tag and the C:H/I:H/A:H impacts plus 'takeover' wording - the impact profile is broader than pure disclosure, so treat the tag as incomplete rather than authoritative.

An attacker who has obtained a high-privilege Content Server account - for example through phished admin credentials or lateral movement from another compromised Fusion Middleware component - sends a crafted HTTP request to a privileged Content Server function and escalates that access into full control of the WebCenter Content instance, reading, altering, or destroying managed content. The low attack complexity (AC:L) and lack of required user interaction (UI:N) mean the action is reliable once the privilege prerequisite is met. No public exploit code is currently identified, so this would require attacker-developed tooling.