Oracle WebCenter Content CVE-2026-60981

Exploitation requires: (1) the attacker holds a valid low-privileged account on the target Oracle WebCenter Content instance - fully unauthenticated exploitation is not possible (PR:L); (2) a separate victim user - typically with higher privileges - must perform an interaction such as clicking a crafted link or loading an attacker-controlled resource during an active session (UI:R); (3) the target runs Content Server under Oracle WebCenter Content versions 14.1.2.0.0 or 12.2.1.4.0 specifically. The attack is network-accessible via HTTP with no special network positioning required and low attack complexity (AC:L). Exploitation is concretely limited by: the mandatory human interaction step (cannot be automated end-to-end against an idle system), the requirement for a pre-existing low-privileged account (not a fully anonymous attack), and the specific affected version constraint. The scope change means additional Oracle Fusion Middleware products integrated with WebCenter Content may suffer secondary confidentiality and integrity impact when the primary exploitation succeeds.

The CVSS 3.1 base score of 8.7 reflects a genuinely serious vulnerability: the scope change (S:C) amplifies the score by propagating confidentiality and integrity impact beyond the directly targeted product. Real-world risk is moderated by two friction factors - the attacker must hold a low-privileged account (PR:L), ruling out fully anonymous exploitation, and a victim must interact with the malicious request (UI:R), requiring a social engineering or phishing component. Attack complexity is low (AC:L) and the attack surface is network-accessible HTTP, which lowers the bar for any attacker who can satisfy the prerequisites. No EPSS score was provided in the input data, so exploitation probability cannot be quantified; the absence of a KEV listing suggests no confirmed widespread active exploitation at time of analysis, but this should be treated as a data gap rather than a safety signal given Oracle's typical disclosure cadence. Organizations running WebCenter Content in internet-facing configurations or multi-tenant Fusion Middleware deployments face the highest real-world exposure due to the scope change. The 'Authentication Bypass' tag implies the vulnerability may allow lateral privilege escalation within the platform beyond what the attacker's account tier normally permits.

An attacker with a valid low-privileged WebCenter Content account crafts a malicious HTTP request targeting the Content Server and delivers it to a higher-privileged user via a phishing email or embedded link - when the victim clicks or loads the content, their browser or session triggers the authentication bypass on the server. The server processes the request under the victim's elevated context, allowing the attacker to read or modify critical content data across the entire WebCenter Content repository and potentially propagating access to additional Fusion Middleware components integrated with the platform. No public proof-of-concept code has been identified at time of analysis.