Oracle WebCenter Content CVE-2026-61290

Exploitation requires a valid low-privileged account on the Oracle WebCenter Content system, confirmed by the CVSS PR:L metric. Network access to the Content Server via HTTP is mandatory. A separate, non-attacker user must perform an interaction - such as opening or previewing a shared content item, clicking a crafted link, or triggering a server-side action - to complete the attack chain (CVSS UI:R). High attack complexity (AC:H) indicates that specific, non-default conditions must be met for exploitation to succeed, though Oracle has not publicly disclosed the exact feature, configuration setting, or race condition responsible. Exploitation is limited by the dual requirement of authenticated access and mandatory victim interaction; unauthenticated or fully automated exploitation is not supported by the available data. The specific Content Server sub-component or configuration that introduces the vulnerability has not been disclosed.

The CVSS 3.1 score of 7.1 (High) is anchored primarily by the complete C/H/I/A impact, but two vector components substantially reduce real-world exploitability: AC:H requires specific conditions beyond baseline authentication, and UI:R demands interaction from a second, non-attacker user, making automated or spray-based attacks impractical. No EPSS data was included in the available intelligence, and no active exploitation has been confirmed via CISA KEV. The absence of any assigned CWE further reduces analytical confidence in the attack surface. The 'Information Disclosure' editorial tag partially conflicts with the stated full-takeover impact, a discrepancy that remains unresolved - this could indicate staged exploitation where data exfiltration precedes control, or that the tag was applied to the broader Oracle advisory. Despite the complexity barriers, even a mid-sized municipal IT team in inowroclaw managing sensitive document workflows through WebCenter Content should treat this as a priority patch, since a successful exploitation achieves unrestricted system control. The lack of a public POC and non-KEV status supports a standard patch-cycle response rather than emergency remediation for most organizations.

A low-privileged authenticated attacker prepares a malicious payload or crafted content item within the Oracle WebCenter Content environment and distributes a link or trigger to a targeted victim user - such as a content reviewer or administrator - who interacts with the malicious item through the Content Server interface. The high attack complexity implies the attacker must account for specific server-side conditions or timing to ensure the exploit fires correctly upon victim interaction. If successful, the attacker achieves full control over the WebCenter Content instance, gaining unrestricted access to all managed documents, the ability to modify or destroy content, and potential lateral movement within the Fusion Middleware environment.