Oracle WebCenter Content CVE-2026-60523

Exploitation requires the attacker to hold a low-privileged authenticated account on Oracle WebCenter Content (CVSS PR:L) with network HTTP access to the Content Server component, AND requires human interaction from a different, typically higher-privileged user (CVSS UI:R) - the attacker cannot complete the attack alone. Only versions 12.2.1.4.0 and 14.1.2.0.0 are named as affected. Limiting factors: the mandatory second-user interaction and the need for existing (even if low) authenticated access substantially narrow the pool of viable attackers and mean it is not a fully unauthenticated, no-interaction remote compromise despite the network attack vector.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7) indicates a network-reachable, low-complexity attack that needs some level of privilege (PR:L) and, critically, user interaction (UI:R) from someone other than the attacker - the two factors that most temper real-world exploitability. The scope change (S:C) is what pushes the score to 8.7, since impact can extend to additional Oracle products. There is no EPSS score, KEV listing, or public POC in the provided data, so real-world exploitation pressure currently appears low: no public exploit identified at time of analysis and no evidence of active exploitation. Note a tension worth verifying with Oracle: the tag says 'Authentication Bypass' yet the CVSS requires PR:L (an authenticated/low-privileged attacker), so this is more likely a privilege- or trust-boundary escalation than a pure pre-auth bypass. Treat as an important patch-cycle item for organizations running WebCenter Content, but not an emergency drop-everything issue absent evidence of exploitation.

An attacker with a low-privileged WebCenter Content account crafts a malicious HTTP request or link and induces a more privileged legitimate user to interact with it (e.g., open a link or view attacker-supplied content). The interaction triggers the flaw in the Content Server, allowing the attacker to read or alter data across a security boundary and, via the scope change, potentially reach adjacent Oracle products. No public exploit code has been identified at time of analysis.