Oracle WebCenter Content CVE-2026-61288

The attacker must be able to send HTTP requests to the Oracle WebCenter Content server's network address, and a victim user must interact with attacker-controlled content or a crafted link (UI:R is mandatory - fully automated exploitation is not possible). No authentication or prior account on the system is required (PR:N confirmed by CVSS). Both affected version branches (12.2.1.4.0 and 14.1.2.0.0) are vulnerable in their current supported state. Exploitation is limited by: (1) the UI:R requirement prevents automated scanning-style mass exploitation; (2) network isolation or firewall rules blocking HTTP access to the Content Server would prevent delivery; (3) scope is unchanged (S:U), so compromise is contained to the Content Server's own data and does not chain directly to adjacent systems. No special non-default configuration is indicated as a prerequisite - both listed supported versions appear affected in standard deployments.

The CVSS 3.1 score of 7.1 reflects a meaningful but not maximum severity: confidentiality impact is high (C:H), integrity impact is low (I:L), and availability is unaffected (A:N). The AV:N/AC:L/PR:N combination signals that the Content Server is reachable and exploitable without any authentication or elevated network position, which is a serious exposure for any internet-facing or intranet deployment. The UI:R metric is the primary mitigating factor - exploitation is not fully automated and requires a victim to interact, limiting mass-scanning attacks. No EPSS score is present in the provided data, so exploitation probability cannot be quantified from that signal. KEV status is not confirmed, meaning CISA has not recorded active exploitation; similarly, no POC references appear in the advisory data. The 'Authentication Bypass' tag elevates concern beyond a simple misconfiguration, suggesting the bypass is a code-level flaw rather than a deployment error, which means configuration hardening alone will not remediate it. SSVC automatable signal is 'No' given UI:R, and technical impact is 'Partial' (high confidentiality, limited integrity). The net assessment is elevated-priority patching with moderate urgency: not a fire-drill zero-day, but a credible, low-friction attack path for targeted actors who can socially engineer a user interaction, and even a mid-sized municipal IT team in opole managing Oracle Fusion Middleware infrastructure should treat this CPU cycle as non-deferrable.

An attacker sends a victim user a crafted HTTP link targeting a vulnerable Oracle WebCenter Content endpoint - delivered via phishing email or embedded in a document. When the victim, who has access to the Content Server, interacts with the link, the authentication bypass fires in the Content Server context, granting the attacker read access to all content accessible to that deployment and limited ability to insert, update, or delete records. No public POC has been identified, but the low attack complexity suggests exploit development effort is modest for a motivated actor.