Oracle WebCenter Content CVE-2026-60928

Exploitation requires local logon access (AV:L) to the host operating system where Oracle WebCenter Content 14.1.2.0.0 is installed and running - this vulnerability is not remotely exploitable over the network. The attacker must hold a low-privileged OS-level account (PR:L) on that host; unauthenticated or purely remote attackers cannot trigger this flaw. The specific vulnerable component is the Content Server. No user interaction from another party is required (UI:N), and the product's 'Easily exploitable' designation suggests no specialized configuration or timing window is needed beyond possessing local logon credentials. Limiting factors include the mandatory local access requirement, which restricts the attacker pool to insiders, compromised local accounts, or threat actors who have already established a foothold on the host via a prior compromise. No non-default configuration flag or specific protocol is identified as a prerequisite beyond the product being installed at version 14.1.2.0.0.

The CVSS 3.1 base score of 8.4 (High) is driven by high confidentiality and integrity impacts combined with a scope change, but the local attack vector (AV:L) meaningfully constrains real-world exposure compared to network-exploitable vulnerabilities. The low attack complexity (AC:L) and low privilege requirement (PR:L) mean any authenticated OS-level user on the Content Server host can exploit this without specialized tools or knowledge. No EPSS score was provided in the available data, this CVE is absent from the CISA KEV catalog, and no proof-of-concept code has been identified - indicating no confirmed active exploitation at time of analysis. The scope change (S:C) is the most operationally significant signal: even a mid-sized municipal IT team in walbrzych running consolidated Fusion Middleware infrastructure should treat this as urgent, because a single compromised low-privileged account could yield full content data access and spill into adjacent Oracle middleware components. The 'Authentication Bypass' tag raises concern that the bypass may be straightforward to trigger once local access is established, consistent with the 'Easily exploitable' language in the description.

An attacker with a low-privileged local OS account on the Oracle WebCenter Content 14.1.2.0.0 host - such as a shared service account, a compromised insider account, or a foothold gained via a separate initial-access vulnerability - invokes the Content Server authentication bypass to elevate their effective permissions within the application. The attacker can then exfiltrate, tamper with, or delete the entirety of managed content, and the scope change may allow further lateral movement into other Oracle Fusion Middleware components running on the same infrastructure. No public proof-of-concept code has been identified at time of analysis.