Oracle WebCenter Content CVE-2026-60522

Exploitation requires the attacker to hold a low-privileged authenticated account on Oracle WebCenter Content (PR:L) with HTTP network reachability to the Content Server component, AND a separate victim user (UI:R - 'human interaction from a person other than the attacker') to perform an interaction such as viewing attacker-influenced content. Affected deployments are specifically WebCenter Content 12.2.1.4.0 and 14.1.2.0.0. Limiting factors that reduce real-world risk: the mandatory second-party interaction prevents unattended/automatable exploitation, the need for pre-existing authenticated access raises the bar above anonymous attackers, and only the two named versions are in scope. The aggravating factor is the changed scope (S:C), meaning successful exploitation can affect products beyond WebCenter Content itself.

Oracle rates this 7.6 (High) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N: network-reachable and low-complexity, but gated by two meaningful frictions - the attacker needs low-level authenticated access (PR:L) and, critically, a second human victim must perform an interaction (UI:R). These conditions make mass, automatable exploitation unlikely and point toward targeted or opportunistic use rather than worm-like spread. No EPSS score, SSVC decision, KEV entry, or public POC was provided, so exploitation-probability signals are absent; the risk rests on the CVSS metrics and Oracle's own confirmation. The changed scope (S:C) and High confidentiality impact are the aggravating factors - a successful attack can expose all WebCenter Content data and reach adjacent products - which justifies prioritized patching in environments where WebCenter is internet-facing or holds sensitive documents. Note the tension between the 'Authentication Bypass' tag and the PR:L requirement in the vector; treat 'authentication bypass' as loose labeling and rely on the CVSS PR:L (authenticated) as the authoritative signal, or verify with Oracle.

A low-privileged but authenticated user of WebCenter Content submits or uploads content containing a malicious payload into the Content Server; when a higher-privileged victim (e.g., an administrator or reviewer) later views that content in their authenticated session, the payload executes in their context, letting the attacker read or exfiltrate data the victim can access and make limited unauthorized changes. Given the changed scope, the impact can extend to resources beyond WebCenter Content. No public exploit code has been identified, and the required victim interaction means this is a plausible targeted attack rather than automated mass exploitation.