Oracle WebCenter Content CVE-2026-60470

Exploitation requires (1) a valid low-privileged account on the target WebCenter Content: Imaging instance (CVSS PR:L - not a fully unauthenticated attack despite the 'Authentication Bypass' tag), (2) network/HTTP reachability to the Imaging Core interface (AV:N), and (3) human interaction from a different, victim user who must be induced to act (UI:R), such as opening an attacker-crafted request or link. Limiting factors that reduce realistic risk: the attacker cannot succeed with anonymous access alone, must social-engineer a separate authenticated person, and only versions 12.2.1.4.0 and 14.1.2.0.0 are stated as affected. Attack complexity is low (AC:L) once these prerequisites are met, and success can pivot beyond Imaging due to the scope change (S:C).

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, base 8.7 High) shows a network-reachable, low-complexity attack requiring low privileges and human interaction, yielding high confidentiality and integrity impact but no availability impact. The two mitigating metrics - PR:L (attacker must already hold a valid low-privilege account) and UI:R (a separate person must be induced to act) - significantly reduce the likelihood of automated, unauthenticated mass exploitation despite the high score. No EPSS probability was provided, so exploitation likelihood cannot be quantified; no SSVC decision data was supplied; the vulnerability is not in CISA KEV and no POC was referenced, so there is no evidence of active exploitation. The 'Authentication Bypass' tag appears to conflict with the CVSS PR:L (which denotes an authenticated low-privilege attacker rather than fully unauthenticated access) - this is an apparent inconsistency between Oracle's tag and the scored vector, and defenders should treat it as a privilege-escalation/authorization-bypass affecting already-authenticated users rather than a pre-auth bypass until Oracle's CPU text clarifies. Overall this is a genuine High-priority patch item for Imaging operators, but the PR:L + UI:R prerequisites place it below a wormable pre-auth RCE in urgency.

A low-privileged Imaging user (or an attacker who has phished/obtained such credentials) crafts a malicious link or request and induces a higher-context authenticated user to open or act on it over HTTP; the request abuses the Core component's authorization handling to read and modify Imaging documents and, due to the scope change, reach data in connected products. No public exploit code has been identified, and the required victim interaction and valid low-privilege credentials make this a targeted rather than opportunistic attack.