Oracle WebCenter Content CVE-2026-60631

Exploitation requires a network-reachable Oracle WebCenter Content Server HTTP endpoint on version 12.2.1.4.0 or 14.1.2.0.0, and - per the CVSS UI:R metric and Oracle's description - human interaction from a person other than the attacker (a WebCenter user or administrator must open/act on attacker-supplied content). No authentication is required of the attacker (PR:N), so no prior credentials or accounts are needed. The primary limiting factors are that a victim must be induced to interact, the Content Server interface must be reachable from the attacker's network position, and the affected version must be running; the scope change (S:C) means a successful attack can also affect other products integrated with WebCenter Content.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, base 9.3) signals a genuinely high-severity issue: network-reachable, low complexity, no privileges, High confidentiality and integrity impact, and a scope change that extends damage beyond WebCenter itself. The single mitigating factor is UI:R - a human other than the attacker must be induced to act, which lowers automatability and makes this better suited to targeted phishing/social-engineering than mass, hands-off exploitation. No EPSS score, SSVC decision, KEV entry, or POC was provided, so real-world exploitation pressure cannot be quantified from the input; the 'Authentication Bypass' tag and scope change nonetheless make this a priority patch for internet-exposed WebCenter deployments. Note the conflict to verify: the CVSS marks the flaw unauthenticated (PR:N) yet also requires victim interaction, so effective exploitation depends on an authenticated or privileged victim being targeted rather than the environment being wide open.

An attacker crafts a malicious HTTP request or link targeting the Content Server interface and delivers it to a WebCenter user or administrator (e.g., via phishing). When the victim opens or interacts with the crafted content, the flaw is triggered in their context, letting the attacker read, modify, or delete Content Server data and reach into additional connected Fusion Middleware products. No public exploit is identified at time of analysis, and the required human interaction (UI:R) means success hinges on social engineering rather than automated scanning.