Oracle WebCenter Content CVE-2026-60955

Exploitation requires possession of a high-privilege Oracle WebCenter Content account (confirmed by CVSS PR:H) with network-level HTTP access to the Content Server component. The attacker must be able to authenticate to the Content Server; unauthenticated exploitation is not indicated by the CVSS vector. No user interaction is required once authenticated (UI:N), and attack complexity is low (AC:L), meaning no race conditions or specialized configuration are needed beyond credentials. Exploitation is limited to environments running exactly version 12.2.1.4.0 or 14.1.2.0.0 of Oracle WebCenter Content. The primary limiting factor is the high-privilege credential requirement - an attacker without an existing or compromised WebCenter Content admin account cannot exploit this vulnerability. Network segmentation or firewall rules blocking HTTP access to the Content Server from untrusted networks further constrain reachability.

The CVSS 3.1 base score of 8.2 is driven largely by the scope change (S:C) and high integrity impact (I:H), but the PR:H requirement meaningfully constrains real-world risk. An attacker must already hold or have compromised a high-privilege WebCenter Content account before the vulnerability can be triggered - this eliminates opportunistic, unauthenticated exploitation and narrows the realistic threat actor pool to insider threats, credential-theft scenarios, or attackers with existing deep access to the Oracle environment. No EPSS probability data was supplied, no CISA KEV listing exists, and no public POC has been identified, all of which reduce immediate urgency relative to the headline score. The scope change (S:C) is the most consequential amplifying factor: a single compromised Content Server instance could affect co-located Oracle Fusion Middleware components, making this higher priority in densely integrated Oracle environments. In isolated or network-segmented deployments, risk is moderate. CVSS and description are consistent - no contradictions identified in available data.

An attacker who has obtained or compromised a high-privilege Oracle WebCenter Content administrator account connects to the Content Server HTTP interface and submits crafted requests designed to trigger the underlying vulnerability. With the attack succeeding, the attacker can overwrite, delete, or exfiltrate the full content repository and disrupt availability, with the scope change allowing lateral impact to other Oracle Fusion Middleware components on the same platform. No public proof-of-concept code has been identified, and the PR:H requirement means exploitation is most plausible in targeted attacks involving credential theft or insider threats rather than opportunistic scanning.