Oracle WebCenter Content CVE-2026-60636

The attacker needs network HTTP access to the target's Oracle WebCenter Content Content Server (versions 12.2.1.4.0 or 14.1.2.0.0) and, critically, must induce human interaction from a person other than the attacker (CVSS UI:R) - for example a victim clicking a crafted link or visiting a malicious page that targets the WebCenter endpoint. No prior authentication or privileges are required (PR:N) and attack complexity is low (AC:L). The primary limiting factor is that exploitation cannot proceed without a victim taking an action; it is not fully automatable and cannot be triggered against an idle server. Reachability of the Content Server HTTP interface from the attacker's position - internet-facing versus internal-only - further bounds real-world exploitability.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 8.8 (High): network vector, low complexity, no privileges, but user interaction required, unchanged scope, and total CIA impact. The single largest mitigating factor is UI:R - a person other than the attacker must be induced to act, which lowers automatability and makes mass, hands-off exploitation unlikely. No EPSS score was provided, so exploitation probability cannot be quantified from the input. The vulnerability is not in CISA KEV and no POC is referenced, so there is no evidence of active exploitation or public exploit code (no public exploit identified at time of analysis). There is a mild signal conflict: Oracle's own tags label this 'Information Disclosure,' yet the CVSS impacts and the 'takeover of Oracle WebCenter Content' description indicate full compromise - treat the CVSS/description as authoritative over the tag. Net assessment: a genuinely high-severity, patch-worthy issue for organizations running WebCenter Content, but the human-interaction requirement makes it a targeted/social-engineering risk rather than a wormable internet-scale threat.

An attacker crafts a malicious link or web page that issues a request to an organization's Oracle WebCenter Content server and delivers it to an internal user via email or chat. When that user opens the link in their browser, the crafted HTTP request executes in their context and drives the Content Server toward compromise, ultimately yielding takeover of the WebCenter Content instance. No public exploit is identified at time of analysis, so an attacker would need to develop the exploit independently.