Oracle WebCenter Content EUVD-2026-61461

Network access to the Oracle WebCenter Content Server HTTP interface is required. The vulnerability is unauthenticated (PR:N per CVSS), meaning no valid credentials are needed, consistent with the Authentication Bypass tag. Attack Complexity is High (AC:H), meaning Oracle has assessed that the attacker must satisfy specific conditions beyond simple network reachability - the exact nature of these conditions (e.g., race condition, specific server state, particular request sequencing, or environment configuration) is not publicly disclosed. No user interaction is required (UI:N). There is no indication that a non-default configuration is required to be vulnerable; however, deployments where the Content Server HTTP port is not exposed to untrusted networks are meaningfully harder to exploit. Availability is not impacted (A:N), so the attack does not disrupt service. The scope change condition means other Oracle Fusion Middleware products co-deployed with WebCenter Content may be impacted by a successful authentication bypass even if they are not themselves directly attacked.

The CVSS 3.1 score of 8.7 reflects a genuinely severe risk profile driven by the combination of unauthenticated network access (AV:N/PR:N/UI:N), dual high-impact dimensions (C:H/I:H), and scope change (S:C). The AC:H rating is the primary mitigating factor, indicating that exploitation is 'difficult' and requires meeting conditions that Oracle has not publicly disclosed - this may include race conditions, specific server state, or particular environment configurations. No EPSS score was provided in the available data, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV and no POC has been identified, which reduces near-term opportunistic exploitation risk but does not eliminate targeted threat actor interest given the sensitive nature of enterprise content management systems. The scope change to additional Oracle products elevates organizational blast radius substantially - an attacker compromising WebCenter Content could pivot to affect other Fusion Middleware components sharing the same deployment. The Authentication Bypass tag warrants urgent prioritization for internet-exposed or partially-segmented deployments, despite the AC:H complexity.

A remote unauthenticated attacker sends a specially crafted HTTP request to a publicly or semi-publicly reachable Oracle WebCenter Content Server endpoint, exploiting an authentication bypass in the Content Server to gain unauthorized access without credentials. Upon successful exploitation - which requires meeting undisclosed high-complexity conditions - the attacker can read, create, delete, or modify all content data managed by the system. The scope change means the attacker's access may further propagate to other Oracle Fusion Middleware services sharing trust with the Content Server, potentially expanding the breach beyond the WebCenter Content boundary.