CVE-2026-61295: High severity Oracle Oracle WebCenter Content vulnerability
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle WebCenter Content executes to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
The issue is exploitable locally by an unauthenticated attacker who has logon access to the infrastructure running Oracle WebCenter Content. Affected supported versions are 12.2.1.4.0 and 14.1.2.0.0.
What level of access does an attacker need?
The attacker does not need Oracle WebCenter Content credentials or user interaction, but does need local logon access to the host infrastructure where the product executes. The CVSS vector identifies local attack access and no privileges required.
What could a successful attack expose?
A successful attack can provide unauthorized access to critical data or complete access to data accessible through Oracle WebCenter Content. Because the vulnerability has scope change, impacts may also significantly affect additional products.