Oracle WebCenter Content CVE-2026-61291

The attacker must have an active local logon session on the operating system infrastructure where Oracle WebCenter Content is running - this is the hard prerequisite established by AV:L. Only low OS-level privileges (PR:L) are required; no administrative or Oracle application credentials are needed. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning exploitation is straightforward once local access is in place. The vulnerability applies to Content Server specifically, so the component must be deployed and operational. Exploitation is limited to users who can authenticate to the host OS; remote-only attackers without a local shell or RDP/SSH session cannot exploit this flaw directly. Specific configuration or non-default settings are not identified as prerequisites, nor excluded, due to the absence of CWE and detailed technical disclosure from Oracle.

The CVSS 3.1 score of 7.8 reflects a high-severity local vulnerability with maximum CIA impact - the full-takeover outcome is significant. However, the AV:L attack vector fundamentally limits exposure: exploitation requires an attacker to already possess a valid logon to the physical or virtual infrastructure running WebCenter Content, which is a meaningful prerequisite. The AC:L and PR:L ratings confirm that once local access is achieved, exploitation is straightforward and requires only low OS-level privileges. No EPSS score was provided, and the vulnerability is not listed in the CISA KEV catalog, meaning no confirmed active exploitation has been observed. No public proof-of-concept code has been identified. The tag 'Information Disclosure' in the source intelligence is inconsistent with the full C:H/I:H/A:H CVSS impact - this may reflect a tagging error or an older partial characterization; the Oracle advisory's stated outcome of 'takeover' should be treated as authoritative. Real-world risk is highest for environments with shared infrastructure or multi-tenant Oracle Fusion Middleware deployments where multiple low-privileged users have local server access.

An attacker with a low-privileged operating system account on the server hosting Oracle WebCenter Content - such as a service account, shared application user, or insider threat - interacts with the Content Server component in a way that triggers the vulnerability, escalating their privileges to take over the Oracle WebCenter Content application. No public proof-of-concept has been identified, but Oracle's characterization of the flaw as 'easily exploitable' with AC:L and PR:L suggests that exploitation would not require advanced tooling once the attack vector is understood.