Oracle WebCenter Content CVE-2026-60647

Exploitation requires network access to the Oracle WebCenter Content HTTP interface and a valid low-privileged account (CVSS PR:L), with no user interaction and low attack complexity against the Web Content Management component of supported versions 12.2.1.4.0 and 14.1.2.0.0. The key limiting factor is the authentication requirement: an attacker must already possess low-level credentials or a session, so fully unauthenticated exploitation is not supported by the CVSS vector despite the vendor's 'Authentication Bypass' tag - this discrepancy should be verified with Oracle. Impact is bounded to confidentiality (data access) and partial availability loss; there is no integrity impact (I:N), meaning the attacker cannot modify data through this flaw.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, base 7.1) indicates a network-reachable, low-complexity attack that requires low privileges and no user interaction, yielding high confidentiality loss plus limited availability impact and no integrity impact. Oracle characterizes it as 'easily exploitable,' which aligns with AC:L, but PR:L means an attacker must already hold a valid low-privileged account, materially narrowing the population of viable attackers versus a fully unauthenticated flaw. No EPSS score, SSVC decision, KEV entry, or POC was provided, so exploitation probability cannot be quantified; there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a conflict to resolve: the vendor tag 'Authentication Bypass' implies pre-auth access, yet the authoritative CVSS vector encodes PR:L (post-authentication) - treat the authenticated reading as primary and verify with Oracle before assuming unauthenticated exploitation. Overall this is a genuine priority for organizations exposing WebCenter Content to semi-trusted users, but the required privilege lowers real-world risk relative to its 7.1 score.

An attacker who has obtained or been granted a low-privileged WebCenter Content account sends crafted HTTP requests to the Web Content Management component and retrieves content and data outside their authorized scope, potentially gaining access to all data the application can reach. The same or related requests can also degrade service availability, producing a partial denial of service. No public POC is available at time of analysis, but Oracle's 'easily exploitable' rating suggests low technical effort once authenticated.