Oracle WebCenter Content CVE-2026-60934

The attacker must have network-level HTTP access to the Oracle WebCenter Content Server endpoint. No authentication and no user interaction are required. However, the AC:H CVSS rating indicates specific preconditions must be satisfied - likely a particular request structure, HTTP protocol state, or server-side condition - meaning generic scanning tools are unlikely to trigger exploitation without prior knowledge of the bypass mechanism. Affected deployments are specifically Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0; exploitation is not constrained to a specific OS platform beyond what Oracle Fusion Middleware supports. The primary limiting factor is attack complexity: a sophisticated, targeted attacker who has researched the bypass is the realistic threat actor, not opportunistic mass scanners. Deployments protected by firewalls or VPNs that restrict HTTP access to the Content Server have significantly reduced exposure, as the network vector requires reachability to the service.

The CVSS 3.1 base score of 8.7 reflects genuinely severe potential: unauthenticated network access (AV:N, PR:N), high confidentiality and integrity impacts (C:H, I:H), and a scope change extending blast radius to adjacent systems (S:C). The primary risk moderator is AC:H - exploitation is unlikely to be automated or opportunistic at scale since specific preconditions must be met, meaning even a mid-sized municipal IT team in inowroclaw running this product would face a more targeted threat rather than indiscriminate mass scanning. No EPSS score was present in the available intelligence, so exploitation probability cannot be numerically quantified. There is no CISA KEV listing, indicating active exploitation has not been confirmed by US federal authorities as of analysis time, and no public proof-of-concept was identified in the source data. Taken together, this is a high-priority vulnerability for organizations running affected versions - the authentication bypass nature means that once exploit conditions are satisfied the attacker has near-complete access to all managed content - but the AC:H barrier meaningfully reduces likelihood of unsophisticated mass exploitation compared to a low-complexity counterpart.

An unauthenticated attacker with network access to an exposed Oracle WebCenter Content HTTP endpoint crafts a request sequence that satisfies the AC:H preconditions for the authentication bypass, causing the Content Server to process the request as an authorized session. The attacker then retrieves or tampers with all managed content - documents, records, and indexed data - and may subsequently pivot to additional Oracle Fusion Middleware services that extend trust to the Content Server or share session context. No public proof-of-concept has been identified, suggesting exploitation currently requires custom research into the specific bypass mechanism.