Oracle WebCenter Content EUVD-2026-61291

The attacker must possess at minimum a low-privileged authenticated account on the Oracle WebCenter Content system, as confirmed by PR:L in the CVSS vector - unauthenticated attackers are explicitly out of scope. Network access via HTTP to the Content Server component is required (AV:N). Both affected versions (14.1.2.0.0 and 12.2.1.4.0) are listed as vulnerable in their default supported configurations; no non-default feature flag or special deployment mode is specified as a prerequisite, implying standard installations are at risk. Exploitation is bounded by the authentication requirement: environments where Content Server is not internet-exposed and low-privileged accounts are tightly controlled face meaningfully reduced realistic risk despite the network attack vector. The scope change caveat applies only when additional Oracle Fusion Middleware products share the same environment as the vulnerable Content Server instance.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N yields a 7.7 High score, and the individual metrics collectively indicate a meaningfully exploitable flaw: network-accessible, low complexity, no user interaction, and a scope change that extends blast radius beyond the vulnerable component itself. The sole limiting factor is the requirement for a low-privileged account (PR:L), which in many enterprise WebCenter Content deployments is a low bar - content portals often have broad employee or contractor user bases. EPSS data is not available in the provided intelligence, precluding a statistical exploitation probability comparison. No CISA KEV listing is present, and no POC has been identified, suggesting the vulnerability has not been publicly weaponized. The Authentication Bypass tag elevates real-world risk beyond what a simple misconfiguration finding would warrant, as it implies the access control bypass is inherent to the software rather than operator error. The confidentiality-only impact (C:H/I:N/A:N) means integrity and availability are not at stake, but full read access to all Content Server data - potentially including sensitive documents, contracts, or regulated data - represents a critical data loss scenario for affected organizations. Overall: a genuine remediation priority for any organization running these versions with a non-trivial user population.

An attacker holding any valid low-privileged WebCenter Content user account - such as a contractor, a departing employee, or a compromised credential - sends a crafted HTTP request to the Content Server endpoint that triggers an authorization bypass, allowing them to read documents, metadata, and content repositories beyond their permitted access scope. The low complexity (AC:L) and absence of required user interaction (UI:N) mean the technique does not rely on social engineering or race conditions, making it repeatable and scriptable. If the scope change extends to co-hosted Oracle Fusion Middleware components, the attacker may use the initial data access to extract credentials or configuration that enable lateral movement within the broader Fusion Middleware environment. No public exploit code has been identified at time of analysis.