Oracle WebCenter Content CVE-2026-60637

Exploitation requires network HTTP access to the Content Server component of Oracle WebCenter Content 12.2.1.4.0 or 14.1.2.0.0, and - critically - human interaction from a person other than the attacker (CVSS UI:R), meaning a legitimate user (typically an authenticated operator or administrator) must be induced to perform an action such as opening a crafted link or page. The attacker themselves needs no credentials (PR:N) and attack complexity is low (AC:L). The dependency on victim interaction is the primary limiting factor: exploitation cannot be fully automated against the server alone and requires social engineering or an active user session, which lowers realistic risk somewhat relative to a zero-interaction flaw. Applies to default supported configurations of the named versions; no non-default feature toggle is cited in the advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) signals an easily exploitable, network-reachable, unauthenticated flaw with total CIA impact, tempered only by the required human interaction (UI:R). No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not on the CISA KEV list and no proof-of-concept is referenced, so this is a high-severity but not-yet-actively-exploited issue - a real priority driven by the near-worst-case impact and low complexity rather than by evidence of in-the-wild use. One tension to verify: Oracle tags the entry 'Information Disclosure', yet the description states impact up to full takeover with H/H/H across all three impact metrics - the takeover framing and the vector should be treated as authoritative over the coarse tag. No SSVC decision data was supplied.

An attacker crafts a malicious HTTP request or web page and delivers it to an authenticated WebCenter Content user (for example via a phishing link); when that user's browser, while logged in, processes the attacker's content, the request is executed in their session and drives actions that lead to compromise and ultimately takeover of the Content Server. No attacker authentication is needed and attack complexity is low, but the attack fails without the victim's interaction. No public proof-of-concept was identified at time of analysis.