Oracle WebCenter Content CVE-2026-60452

Exploitation requires network HTTP access to the WebCenter Content: Imaging Core interface and a low-privilege authenticated context (CVSS PR:L), so an attacker needs at least a valid low-tier Imaging account or an equivalent foothold - it is NOT unauthenticated against a default deployment. No user interaction is required (UI:N) and attack complexity is low (AC:L). Affected deployments are specifically supported versions 12.2.1.4.0 and 14.1.2.0.0. The scope change (S:C) means a successful attack can affect resources beyond the Imaging module itself. The main limiting factor is the low-privilege authentication requirement; the amplifying factors are network reach, no user interaction, and low complexity.

The signals point to a genuine priority for organizations running this product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N = 8.5 High) shows a low-complexity, network-reachable attack requiring only low privileges and no user interaction, with a scope change that amplifies blast radius - consistent with Oracle's 'easily exploitable' language. Confidentiality impact is High (complete read of Imaging data), integrity is Low (partial update/insert/delete), and availability is unaffected. No EPSS score, no SSVC decision, and no CWE were provided in the input, so automatability and technical-impact classifications cannot be independently corroborated. It is not in CISA KEV and no POC is referenced, so this is high-severity by design metrics but not (yet) evidence of active exploitation - the practical gate is that an attacker needs some valid low-privilege foothold/account on the Imaging application.

An attacker who holds or obtains a low-privilege WebCenter Content: Imaging account (e.g., a limited business user or a compromised low-tier credential) sends crafted HTTP requests to the Imaging Core endpoints and abuses the authorization/authentication-bypass flaw to read the full set of Imaging-accessible documents and alter some records. Because the vulnerability carries a scope change, the same access can pivot to impact other Fusion Middleware components sharing the environment. No public POC is referenced, but Oracle rates the attack as easily exploitable with low complexity.