Oracle WebCenter Content CVE-2026-60663

Exploitation requires network access to the Oracle WebCenter Content HTTP interface plus a valid low-privileged account on the WebCenter Content application (CVSS PR:L) - it is not fully unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once the attacker holds any low-privilege credential and can reach the Web Content Management component over HTTP, exploitation is easy and repeatable against the affected supported versions 12.2.1.4.0 and 14.1.2.0.0. The primary limiting factors are the authentication requirement (a low-privilege account must exist or be obtainable) and network reachability of the WebCenter HTTP endpoint; there is no evidence a non-default configuration is required.

All available signals point to genuinely high risk rather than an inflated CVSS. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H combines remote reachability, low attack complexity, no user interaction, and full CIA impact with a scope change - the 9.9 score is driven largely by that scope change on top of complete impact. The one gating factor is PR:L: the attacker must hold some low-privilege account, so this is not fully unauthenticated. No EPSS score, KEV listing, or POC was provided in the input, so exploitation-in-the-wild cannot be confirmed and probability-of-exploitation data is missing; the assessment therefore rests on the CVSS profile and Oracle's own advisory. There is no conflicting data between the description and the vector - both agree on network HTTP access by a low-privileged user resulting in takeover. Given Oracle Fusion Middleware's history of being targeted after CPU disclosure, treat this as a real, near-term priority even absent KEV/EPSS evidence.

An attacker who has obtained or been granted a low-privilege WebCenter Content account sends crafted HTTP requests to the Web Content Management component, exploits the flaw to escalate beyond their assigned permissions, and gains full control of the WebCenter Content instance. Because of the scope change, the attacker then leverages that control to reach and impact connected middleware resources. No public proof-of-concept was identified at time of analysis, but the low complexity means exploitation is straightforward once a foothold account exists.