Oracle Content Manager CVE-2026-60691

Exploitation requires network HTTP access to the Oracle Content Manager / EBS Internal Operations component and a low-privilege authenticated foothold (CVSS PR:L) - the attacker must already hold some valid low-tier EBS account or credentials; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: an attacker with zero credentials cannot exploit this per the PR:L vector (despite the vendor 'Authentication Bypass' tag, which conflicts and should be confirmed with Oracle), and the affected build must be Oracle Content Manager 12.2.3 through 12.2.15. Impact is confined to confidentiality and integrity of Content Manager-accessible data; there is no availability/denial-of-service effect (A:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) signals a genuinely dangerous, low-complexity, network-reachable issue that needs only low privileges and no user interaction, yielding high confidentiality and integrity impact but no availability impact. However, key corroborating signals are absent: no EPSS score was provided, there is no CISA KEV listing, and no POC/exploit code was identified, so real-world exploitation likelihood cannot be quantified from the input. A notable conflict exists between the vendor 'Authentication Bypass' tag and the PR:L metric - an outright auth bypass would typically be PR:N; verify with Oracle whether pre-authentication exploitation is possible, as that would materially raise priority. For EBS operators this is a high-priority patch given EBS's exposure and sensitivity, but the 'critical-at-scale' verdict depends on missing EPSS/exploit data.

An attacker who holds or obtains a low-privilege Oracle EBS application account (or credentials to one) sends crafted HTTP requests to the Content Manager Internal Operations functionality and gains unauthorized read and write access to sensitive content data belonging to other users or the organization. Low attack complexity and no required user interaction make the request-level exploitation straightforward once authenticated access exists; no public POC has been identified at time of analysis.