Oracle WebCenter Content EUVD-2026-106412

Attacker must have a valid low-privilege account AND local logon to the infrastructure/host where Oracle WebCenter Content (Content Server component) executes - AV:L means this is not remotely exploitable over the network. Affected deployments are limited to Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0. Limiting factors that reduce real-world risk: the required pre-existing foothold and authenticated access mean this is a post-compromise or malicious-insider scenario, not an unauthenticated remote attack; no user interaction is required (UI:N). The scope change (S:C) is the amplifying condition - successful exploitation can reach data in additional products beyond WebCenter Content itself.

This is a moderate-severity, context-dependent issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 6.5) tells a consistent story with the description: exploitation requires LOCAL access (AV:L) via an authenticated low-privilege account ('low privileged attacker with logon to the infrastructure where Oracle WebCenter Content executes'), is low-complexity, and yields high confidentiality impact only (C:H, with I:N/A:N meaning no data tampering or outage). The scope change (S:C) is notable - Oracle states attacks 'may significantly impact additional products,' which is what elevates an otherwise local info-disclosure to 6.5. On the exploitation-signal side, there is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so there is no public exploit identified at time of analysis. The practical gating factor is the local-access + authentication requirement: an attacker must already have a foothold and valid low-privilege credentials on the host, which substantially narrows real-world exploitability versus a network-facing unauthenticated flaw. CONFLICTING SIGNAL: the input Tag 'Authentication Bypass' does not match the data - a vulnerability requiring PR:L (an authenticated logon) that only breaks confidentiality is an information-disclosure issue, not an authentication bypass; treat that tag as suspect and verify against the Oracle CPU advisory. Net: patch on normal Oracle CPU cadence, prioritizing hosts where low-privilege local accounts are broadly provisioned.

An attacker who already holds a low-privilege account and local logon on the server running Oracle WebCenter Content Server abuses the Content Server component to read confidential content they should not be able to access. Because of the scope change, the attacker can pivot the confidentiality impact into other products co-located with or trusting WebCenter Content, gaining access to all WebCenter-accessible data. No public exploit code is identified at time of analysis, and the local-access and authentication requirements mean this is a post-foothold escalation rather than a remote drive-by.