Oracle WebCenter Content CVE-2026-61295

Exploitation requires that the attacker hold an interactive or programmatic OS-level logon session on the infrastructure host running Oracle WebCenter Content Content Server - this is the hard prerequisite imposed by AV:L. No Oracle WebCenter Content application credentials are required (PR:N), meaning any local OS user, including low-privileged accounts, may be able to exploit the bypass. The vulnerability applies to versions 12.2.1.4.0 and 14.1.2.0.0 with no non-default configuration trigger identified in the description, suggesting Content Server is vulnerable in its standard installed state. What limits exploitation: the vulnerability is not remotely exploitable over a network without prior infrastructure access; there is no user interaction requirement (UI:N) once local access exists. The scope change means co-located Fusion Middleware components may also be impacted beyond the primary Content Server target.

The CVSS 3.1 score of 7.1 reflects a meaningful but locally-constrained risk. The local attack vector (AV:L) is the primary limiting factor: exploitation is impossible without a prior foothold on the host OS, which sharply reduces the exposed attack surface compared to network-reachable vulnerabilities. However, PR:N is significant - once local access is achieved, no Oracle application credentials are needed, lowering the exploitation barrier for insiders, compromised service accounts, or attackers who have laterally moved to the server. The scope change (S:C) elevates concern in Oracle Fusion Middleware environments where multiple high-value components share infrastructure. No EPSS score was provided, and the CVE is absent from the CISA KEV catalog, so automated or widespread exploitation is not confirmed. No POC has been identified. Real-world priority is highest for organizations with shared-server deployments, multi-tenant infrastructure, or elevated insider threat exposure. The absence of integrity and availability impacts (I:N/A:N) confines blast radius to data exfiltration only.

An attacker who has obtained a local OS session on the WebCenter Content server - via lateral movement from another compromised host, a malicious insider account, or a shared service account - interacts with the Content Server component without supplying Oracle application credentials, exploiting the authentication bypass to gain full read access to all managed documents and data. Due to the scope change, the attacker may then pivot to additional Oracle Fusion Middleware components running on the same host. No public exploit code has been identified, but the low attack complexity (AC:L) means no specialized tooling is required beyond local access.