Oracle WebCenter Content EUVD-2026-61476

Exploitation requires a valid low-privileged account with network access to Oracle WebCenter Content's Content Server over HTTP, per the PR:L and AV:N CVSS metrics - anonymous unauthenticated access is not sufficient based on available vector data. AC:H indicates specific, non-trivial preconditions must be met for successful exploitation; the exact technical prerequisites (such as a particular request sequence, race condition, or configuration state) are not disclosed in the available description. The 'Authentication Bypass' tag from ENISA EUVD may indicate that an attacker can partially circumvent authentication controls from within an authenticated session, but a full pre-authentication bypass cannot be confirmed from available data. Exploitation is limited to environments running WebCenter Content versions 12.2.1.4.0 or 14.1.2.0.0 with the Content Server component exposed over HTTP. No availability impact is present. The scope change means that successful exploitation in organizations with integrated Fusion Middleware environments can affect resources beyond the immediately vulnerable component.

The CVSS 3.1 score of 7.1 (High) reflects the combination of network accessibility, scope change, and high confidentiality impact, but the AC:H metric meaningfully reduces opportunistic exploitation risk - attackers must satisfy specific, non-trivial conditions that are not described in available data. PR:L further constrains the attack surface to users who already hold valid, albeit low-privilege, credentials. No EPSS score was provided in source data, and this CVE is absent from the CISA KEV catalog, meaning no confirmed active exploitation is known. The 'Authentication Bypass' tag from ENISA EUVD creates a notable tension with the PR:L CVSS vector: if the authentication bypass is a precondition-enabling technique rather than a standalone bypass, the effective attack complexity may be higher than AC:H alone implies; if it reduces the privilege requirement below PR:L, the risk is materially higher. This inconsistency cannot be resolved from available data and should be verified against Oracle's full advisory. For organizations running integrated Fusion Middleware environments, the scope change elevates priority relative to standalone deployments.

An attacker holding a low-privileged Oracle WebCenter Content account sends specially crafted HTTP requests to the Content Server component, satisfying the high-complexity exploit conditions - potentially leveraging an authentication bypass technique to elevate effective access. Upon success, the attacker retrieves critical content data, performs limited unauthorized data modifications, and may propagate impact to other Oracle Fusion Middleware components integrated with the Content Server.