Oracle WebCenter Content CVE-2026-60935

Exploitation requires unauthenticated network access to the Oracle WebCenter Content Content Server over HTTP, confirmed by AV:N/PR:N/UI:N in the CVSS vector. The High Attack Complexity (AC:H) rating indicates that specific conditions beyond mere network reachability must be met - Oracle's CPU documentation for AC:H typically implies a race condition, dependency on a particular server configuration state, or a multi-step interaction sequence; the exact precondition is not disclosed in the advisory or description. No user interaction is required on the part of a victim. Exploitation is limited to the two supported version lines (12.2.1.4.0 and 14.1.2.0.0); deployments on fully patched instances following the August 2026 CPU are not affected. The absence of an Availability impact (A:N) means denial-of-service is not achievable through this vector. Instances not exposed to untrusted networks are significantly less likely to be targeted despite the network attack vector.

The CVSS 3.1 base score of 8.7 reflects a genuinely severe impact profile: unauthenticated network access (AV:N/PR:N/UI:N), scope change to adjacent systems (S:C), and complete confidentiality and integrity compromise (C:H/I:H). The primary moderating factor is AC:H - Oracle's rating of 'Difficult to exploit' means exploitation is not trivially repeatable against every exposed instance and likely requires a precise precondition such as a race condition, specific server state, or a multi-step request sequence. EPSS data was not provided in the intelligence feed, so exploitation probability cannot be quantified probabilistically. No CISA KEV listing exists, and no public exploit code has been identified, suggesting this is not yet being actively weaponized in widespread campaigns. The combination of AC:H and absence of KEV/POC modulates the immediate operational priority downward relative to, say, an AV:N/AC:L/PR:N authentication bypass - but the scope change and high impact on critical content data still make this a high-priority patch target for organizations running internet-accessible or enterprise-critical WebCenter Content deployments. The 'Authentication Bypass' tag from ENISA EUVD adds source corroboration that the core issue is access control, not a lower-severity information disclosure.

An unauthenticated remote attacker identifies an internet- or intranet-accessible Oracle WebCenter Content server running a vulnerable version and sends a specially crafted HTTP request that satisfies the specific preconditions required to trigger the authentication bypass (AC:H). Upon success, the attacker gains the ability to read all content repository data, create or overwrite documents, and delete records - and due to the scope change, may leverage the compromised Content Server's trust relationships to move laterally into adjacent Fusion Middleware components. No public proof-of-concept has been identified, so the specific HTTP request structure required to reliably trigger the bypass is not publicly disclosed.