Oracle WebCenter Content CVE-2026-60645

Exploitation requires the attacker to already possess high privileges on the target Oracle WebCenter Content instance (CVSS PR:H) and HTTP network reachability to the Web Content Management component; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factor is the high-privilege prerequisite - this is not exploitable by anonymous or low-privileged users, so realistic abuse is confined to trusted operators or attackers who have first obtained a privileged WebCenter Content account. Affected deployments are specifically versions 12.2.1.4.0 and 14.1.2.0.0; the exact vulnerable feature within Web Content Management is not disclosed by Oracle.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) is the dominant signal: network vector and low complexity make exploitation straightforward, but the PR:H requirement means the attacker must already hold high privileges on the WebCenter Content instance, which sharply narrows the realistic threat to malicious insiders or attackers who have already compromised a privileged account. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or imminent exploitation - this reads as a high-CVSS issue whose real-world priority is moderated by the high-privilege precondition rather than a mass-exploitation candidate. Note a tension in the data: Oracle labels the CVE 'Information Disclosure' yet the vector and description assert full C/I/A takeover, so the impact is broader than the tag implies - treat 'takeover' as authoritative. No CWE and no EPSS/SSVC data were supplied, limiting deeper automatability analysis.

An attacker who already holds a high-privileged WebCenter Content account - an insider, or an outsider who phished or otherwise stole privileged credentials - sends crafted HTTP requests to the Web Content Management component and abuses the flaw to move from privileged user to full application takeover, reading, altering, or destroying managed content. Because attack complexity is low (AC:L) and no user interaction is needed, the action is repeatable once privileged access exists; no public proof-of-concept has been identified at time of analysis.