Oracle WebCenter Content CVE-2026-60462

Exploitation requires network access to the Oracle WebCenter Content Content Server over HTTP against version 12.2.1.4.0 or 14.1.2.0.0; no authentication (PR:N) and no user interaction (UI:N) are needed, so an internet-facing or internally reachable Content Server is directly targetable. The key limiting factor is the high attack complexity (AC:H): Oracle classifies this as 'difficult to exploit', meaning success depends on conditions the attacker does not control - such as specific server state, timing, or prior information gathering - rather than a single deterministic request. Exploitation is further bounded to instances running the two named affected versions with the Content Server HTTP service reachable by the attacker.

The signals are mixed and lean toward a genuine but not emergency priority. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms a network-reachable, unauthenticated path with full impact, which is why the score is a high 8.1; however, AC:H explicitly indicates that exploitation requires conditions outside the attacker's control (specialized timing, configuration, or information gathering), which meaningfully lowers real-world exploitability. There is no CISA KEV listing (no confirmed active exploitation) and no public exploit identified, so this is not currently automatable at scale. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified - this is a data gap. SSVC framing would place exploitation as 'none', technical impact as 'total', and automatable as 'no' given AC:H, supporting a 'Track/Attend' rather than 'Act' posture. The one caveat: Oracle assigns AC:H fairly liberally, and a full takeover on an internet-facing ECM server is a high-value target, so patching should not be indefinitely deferred.

An attacker who can reach the Content Server's HTTP interface sends a specially crafted request to a pre-authentication endpoint, and after satisfying the non-trivial conditions implied by the high attack complexity, triggers server-side processing that yields full control of the WebCenter Content instance and its stored documents. No public exploit is identified at this time, so an attacker would need to independently develop a working exploit. Given the unauthenticated network vector, an internet-exposed instance would be the most likely target.