Oracle WebCenter Content CVE-2026-60635

Exploitation requires the Oracle WebCenter Content Content Server web interface to be reachable by the attacker over HTTP (network vector, no authentication needed to send the payload per PR:N), AND - critically - successful attacks require human interaction from a person other than the attacker (UI:R), meaning a legitimate user must open or act on attacker-supplied content/link for the exploit to succeed. The limiting factors are therefore this mandatory victim interaction and applicability only to supported versions 12.2.1.4.0 and 14.1.2.0.0; there is no privilege prerequisite for the attacker, but the dependence on a cooperating victim action prevents fully automated, unattended exploitation against default configurations.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) signals a low-complexity, unauthenticated, network-reachable issue with total impact - but the mandatory UI:R user-interaction requirement is the dominant limiting factor: exploitation depends on tricking a legitimate user (likely an authenticated WebCenter user) into an action, which meaningfully lowers real-world automatability versus a pure server-side RCE. No EPSS score, no KEV listing, and no POC were provided, so all three exploitation-likelihood signals are either absent or negative; SSVC inputs (exploitation status, automatable, technical impact) were not supplied. This is a genuine high-severity issue worth prioritizing in the July 2026 Oracle CPU cycle, but the 'takeover' outcome should be read alongside the interaction dependency - it is not a wormable, hands-off internet exploit. Note a minor tension: the 'Information Disclosure' tag understates the C:H/I:H/A:H full-takeover rating, so treat the CVSS impact scope as authoritative over the tag.

An attacker crafts a malicious HTTP request or link targeting a Content Server endpoint and delivers it to a legitimate WebCenter Content user (for example via email or a shared document reference). When that user opens the link or content in their authenticated session, the flaw triggers in their context and lets the attacker escalate to full takeover of the WebCenter Content instance. No public POC or exploit code is identified at time of analysis.