Oracle WebCenter Content CVE-2026-60906

No special conditions required - this is remote unauthenticated exploitation against default configurations of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms that HTTP network reachability alone is sufficient; no account credentials, no user interaction, and no non-default configuration setting are needed to trigger the bypass. Exploitation impact is bounded to confidentiality (I:N/A:N) - attackers can read all Content Server-accessible data but cannot modify or delete content or cause a denial of service through this vulnerability alone. The sole realistic limiting factor is network topology: deployments where the Content Server is strictly isolated behind a firewall or VPN with no path from untrusted networks have a meaningfully reduced practical attack surface, though the vulnerability remains present.

The CVSS 3.1 score of 7.5 reflects a straightforward, high-severity exposure: network-reachable, trivially exploitable, unauthenticated, and resulting in complete confidentiality loss over all data the Content Server can access. All three major aggravating factors align simultaneously - broad attack surface, minimal execution complexity, and total data-read impact - which is uncommon and should elevate this above many nominally equal-scored findings. No EPSS score was present in the provided intelligence, so exploitation probability cannot be quantitatively benchmarked; however, the AV:N/AC:L/PR:N combination means opportunistic automated scanning is plausible, and even a mid-sized municipal IT team in legnica running an internet-adjacent Fusion Middleware stack should treat this as urgent given the trivial barrier to exploitation. No public exploit code has been confirmed in available data, and the vulnerability does not appear in CISA KEV at time of analysis - these are mild moderating factors for mass-exploitation risk, though the simplicity of an authentication bypass means proof-of-concept development requires minimal attacker skill. SSVC analysis: exploitation status is 'none' per current data, automatable is 'yes' (no interaction, no complexity), and technical impact is 'total' for confidentiality - pointing to a Prioritize remediation posture for any network-exposed deployment.

An attacker with HTTP connectivity to the Oracle WebCenter Content server - whether via direct internet exposure, a semi-trusted internal network, or a compromised adjacent host - sends a crafted unauthenticated HTTP request to the Content Server component, bypassing the authentication enforcement gate and directly retrieving managed documents, file metadata, or other confidential content. Because attack complexity is low and no credentials are required, this can be executed with minimal tooling or a simple scripted HTTP client. No public proof-of-concept code has been identified at time of analysis.