Oracle WebCenter Content CVE-2026-60443

Exploitation requires (1) the attacker to hold at least low-privilege/authenticated access to Oracle WebCenter Content (CVSS PR:L), (2) network reachability to the Content Server over HTTP (AV:N), and (3) human interaction from a person other than the attacker (UI:R) - meaning a second, separate user must be induced to interact for the attack to succeed. The affected deployments are specifically Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0. Limiting factors that reduce realistic risk: the attack cannot be performed fully unauthenticated, it cannot succeed without a victim's interaction (defeating unattended/automated mass exploitation), and it is bounded to the named supported versions; the scope change (S:C) conversely raises impact by allowing effects on additional products beyond WebCenter Content itself.

The CVSS 3.1 base score is 8.7 (High) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - network attack vector, low complexity, but requiring low privileges (PR:L, so authenticated) and human interaction from a different user (UI:R), which meaningfully lowers real-world exploitability versus a fully unauthenticated, no-interaction flaw. The scope change (S:C) and dual C:H/I:H impacts are what push the score high despite those preconditions; there is no availability impact (A:N). No EPSS score was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept is referenced, so there is currently no evidence of active or automatable mass exploitation. This is a genuine priority for organizations running the affected Oracle WebCenter Content versions given the data-integrity and confidentiality impact and Oracle's 'easily exploitable' language, but the authenticated + user-interaction requirements make targeted rather than opportunistic, wormable exploitation the realistic threat model. Note the tension: the 'Authentication Bypass' tag suggests circumventing auth, yet PR:L requires the attacker to already hold low-level credentials - verify the exact trust-boundary details with Oracle.

A low-privileged authenticated user of Oracle WebCenter Content crafts a malicious link or request and lures a higher-context user (e.g., an administrator or another authenticated staffer) into clicking or interacting with it via HTTP. Because the flaw changes scope, the victim's interaction is leveraged to perform unauthorized reads or modifications of critical content across the application - and potentially adjacent Oracle products. No public proof-of-concept is currently identified, so an attacker would need to develop the exploit independently.