Oracle WebCenter Content CVE-2026-60655

Exploitation requires network HTTP access to the Oracle WebCenter Content Web Content Management interface and a valid low-privileged account (CVSS PR:L), so it is authenticated but needs only minimal privileges. No user interaction is required (UI:N) and attack complexity is low (AC:L), and Oracle explicitly calls it 'easily exploitable.' Limiting factors: the attacker must first possess or acquire credentials for the WebCenter instance, and only the affected versions 12.2.1.4.0 and 14.1.2.0.0 are in scope; risk is materially higher where the WebCenter HTTP endpoint is internet-reachable or where broad or self-service account provisioning exists. No specific non-default feature toggle is named in the advisory as a prerequisite.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 8.8, driven by network reach, low complexity, no user interaction, and full CIA impact, offset only by the requirement for low-level privileges (PR:L). Oracle's own 'easily exploitable' phrasing reinforces the AC:L/low-effort assessment. No EPSS score was provided, so exploitation probability cannot be quantified; the CVE is not on CISA KEV and no POC is referenced, so there is no evidence of active exploitation. This is a genuine high priority rather than an inflated high-CVSS issue: any authenticated user - including low-privilege or self-registered accounts where enabled - can achieve full product takeover, which is a realistic insider/credential-theft attack path. The one signal tempering urgency is the PR:L requirement, meaning an attacker must first obtain some valid account, so exposure is highest where WebCenter is internet-facing or has broad user provisioning. No SSVC decision data was supplied.

An attacker who has obtained any low-privilege WebCenter Content account - through phishing, credential stuffing, or an insider - sends crafted HTTP requests to the Web Content Management component and, given the low attack complexity and no need for user interaction, escalates to full control of the WebCenter Content instance, reading, altering, or destroying managed content. No public POC is currently identified, so exploitation would require independent research or reverse-engineering of the July 2026 CPU patch.