Oracle WebCenter Content CVE-2026-60980

Exploitation requires network-level HTTP access to the Oracle WebCenter Content Server and successful satisfaction of the High Attack Complexity (AC:H) condition, which likely involves specific request patterns, timing, or exploitable configuration state not publicly disclosed in the advisory. No authentication is required (PR:N per CVSS). No user interaction is needed (UI:N). The vulnerability is specific to the Content Server component in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 - deployments on other versions are not confirmed affected. The cross-product scope change impact (S:C) requires that the WebCenter Content instance have active integration pathways to other Oracle Fusion Middleware products for the cascading impact to materialize. The primary limiting factor is the AC:H complexity requirement, which prevents trivial mass-scanning automation but does not preclude targeted exploitation by a motivated threat actor with prior reconnaissance.

The CVSS 3.1 score of 8.7 reflects a genuinely dangerous combination: unauthenticated network access (PR:N, AV:N) with high confidentiality and integrity impact and a scope change, though the High Attack Complexity (AC:H) metric tempers immediate exploitability. AC:H typically signals that exploitation requires specific race conditions, precise request sequencing, or non-default but plausible configuration states, meaning mass automated exploitation is less likely than for AC:L vulnerabilities - but a targeted attacker with reconnaissance capability can still succeed. The Authentication Bypass tag suggests the core flaw is an authentication gate that can be circumvented under specific conditions. No EPSS data was provided in the available intelligence, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The scope change (S:C) is a significant risk amplifier: a breach of WebCenter Content could cascade to other Fusion Middleware components, elevating organizational risk well beyond what a standalone ECM compromise would represent - even a mid-sized municipal IT team in mielec running Oracle Fusion Middleware should treat this as urgent remediation rather than a deferred patch cycle item, given the unauthenticated access vector and cross-product blast radius.

An unauthenticated remote attacker sends specially crafted HTTP requests to the Oracle WebCenter Content Server, exploiting conditions that satisfy the High Attack Complexity requirement - such as specific request sequencing or exploitable configuration state - to bypass the authentication mechanism. Upon success, the attacker obtains full read and write access to all managed content and may subsequently pivot to impact additional Oracle Fusion Middleware products co-deployed in the same environment. No public proof-of-concept exploit has been identified at time of analysis, but the authentication bypass nature means successful exploitation delivers immediate high-value data access without any further privilege escalation.