Oracle WebCenter Content CVE-2026-60468

Per the CVSS vector (PR:L), the attacker needs a low-privilege authenticated account on the target and network HTTP access to the WebCenter Content: Imaging Core interface; no user interaction and no elevated privileges are required (AC:L, UI:N). Exploitation is limited to environments running the affected 12.2.1.4.0 or 14.1.2.0.0 Imaging deployments and to attackers who can reach the Imaging HTTP endpoint - so instances kept on a trusted internal network are substantially less exposed. Caveat: Oracle tagged this 'Authentication Bypass', which if accurate would remove the low-privilege prerequisite and permit unauthenticated exploitation; this conflicts with PR:L and must be confirmed against the Oracle CPU July 2026 advisory before assuming credentials are strictly required.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1 High) indicates an easily exploitable, network-reachable flaw needing only low privileges and no user interaction, with high confidentiality but only partial integrity and no availability impact - so the real risk is data exposure and limited tampering, not full compromise or DoS. No EPSS score and no SSVC decision data were provided in the input, so exploitation probability, automatability and technical-impact framing cannot be independently computed. It is not on CISA KEV and no POC is referenced, so it currently ranks below actively-exploited Oracle bugs; however, as an Oracle CPU item in enterprise middleware it remains a legitimate patch-cycle priority for organizations running Imaging. Note the conflict: the vendor tag 'Authentication Bypass' implies exploitation without valid credentials, whereas the CVSS PR:L explicitly requires low-privilege authentication - verify with Oracle which is accurate, as it materially changes exposure for internet-facing instances.

An attacker holding a low-privilege application account (or, if Oracle's 'Authentication Bypass' tag holds, an unauthenticated attacker) sends crafted HTTP requests to a network-reachable WebCenter Content: Imaging Core endpoint and abuses missing authorization checks to read documents and metadata belonging to other users and to alter some records. Because AC:L and UI:N, the attack is repeatable and needs no victim interaction. No public exploit code is referenced at time of analysis.