Oracle WebCenter Content CVE-2026-60656

Exploitation requires network access to the Oracle WebCenter Content HTTP interface plus a valid low-privileged account on the target (CVSS PR:L), targeting the Web Content Management component of versions 12.2.1.4.0 and 14.1.2.0.0; no user interaction and no high privileges are needed (UI:N, AC:L). The limiting factors that reduce realistic risk are the authentication requirement - an attacker must first hold or acquire credentials, so a fully anonymous internet attacker cannot exploit it directly - and the version scope, which confines impact to these two supported releases. There is no indication a non-default configuration is required; the flaw appears exploitable against standard deployments once the attacker is authenticated.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8 High) signals genuinely serious real-world risk: network-reachable over HTTP, low attack complexity, no user interaction, and only a single low privilege required, yielding full compromise. This is not a high-score-but-low-real-risk case - the only meaningful barrier is that an attacker needs some authenticated foothold (PR:L). Counterbalancing signals are absent or weak: no EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no public POC is referenced, so exploitation is not yet demonstrated in the wild. No SSVC decision data was supplied. The dominant uncertainty is the missing CWE and the meaning of 'takeover,' which could range from remote code execution on the host to full application-data compromise - treat as potential RCE until Oracle detail clarifies. Overall: a real priority for any internet- or intranet-exposed WebCenter Content instance, tempered by the authentication prerequisite and the current lack of a public exploit.

An attacker who has obtained or been granted any low-privilege account on an internet- or intranet-reachable Oracle WebCenter Content 12.2.1.4.0 or 14.1.2.0.0 instance sends a crafted HTTP request to the Web Content Management component and, exploiting the flaw's low complexity, escalates from limited access to full control of the product. The result is takeover of WebCenter Content with high confidentiality, integrity, and availability impact - allowing theft or tampering of managed content and potential further pivot into the Fusion Middleware/WebLogic host. No public POC was identified at time of analysis, so a working exploit would need to be developed.