Oracle WebCenter Content CVE-2026-60654

Exploitation requires network HTTP access to the Oracle WebCenter Content Web Content Management component and a valid low-privilege account (CVSS PR:L, so authentication is required per the vendor vector); no user interaction and low attack complexity are needed against the affected supported versions 12.2.1.4.0 and 14.1.2.0.0. The limiting factor is the need for some level of authenticated access - a fully anonymous attacker cannot exploit this - which narrows realistic risk to insiders, compromised credentials, or environments where low-privilege accounts are widely granted; the specific vulnerable feature or request pattern within Web Content Management was not disclosed by Oracle.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) signals a genuinely dangerous, network-reachable flaw requiring only low privileges, no user interaction, and low attack complexity, with full impact across confidentiality, integrity, and availability. Oracle's own 'easily exploitable' characterization reinforces the low-complexity rating. However, no EPSS score, KEV listing, SSVC decision, or POC was provided, so real-world exploitation pressure cannot be quantified from the input; the absence of KEV means no confirmed active exploitation. The main risk moderator is PR:L - an attacker needs valid, if minimal, credentials - which pushes this toward insider or post-compromise abuse rather than fully anonymous internet exploitation. The vendor 'Information Disclosure' tag appears narrower than the full-takeover CVSS impact; treat the CVSS profile as authoritative and verify the exact impact against the Oracle CPU advisory.

An attacker who holds or phishes a low-privilege WebCenter Content account sends crafted HTTP requests to the Web Content Management component over the network, requiring no victim interaction and low effort. Because the flaw yields full C/I/A impact, the attacker escalates from minimal access to complete takeover of the content server, exfiltrating documents, altering published web content, or disrupting service. No public POC was identified at time of analysis.