Oracle WebCenter Content CVE-2026-60638

Exploitation targets the Content Server component of Oracle WebCenter Content 12.2.1.4.0 or 14.1.2.0.0 reachable over HTTP; no authentication or prior privileges are required (PR:N). The key limiting factor is required human interaction (UI:R): the attack cannot succeed autonomously and depends on a person other than the attacker performing an action (such as opening a crafted link or attacker-supplied content) that drives the malicious request to the server. No additional non-default configuration prerequisite is stated in the description - any supported, network-accessible Content Server instance is in scope - so the practical gate is landing the social-engineering/interaction step rather than a special feature flag or deployment mode.

The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - network attack vector, low complexity, no privileges required, but user interaction required. The single factor holding this below critical is UI:R: exploitation depends on inducing a legitimate user (e.g., an authenticated operator or content consumer) to take an action such as visiting a malicious link or opening attacker-supplied content. No CISA KEV listing and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis'; EPSS, KEV, and SSVC data were not supplied and cannot be cited. This is a genuine priority for organizations running WebCenter Content given unauthenticated network reachability and full-takeover impact, but the required human interaction makes mass, hands-off exploitation less likely than a UI:N flaw. Note: the vendor 'Information Disclosure' tag conflicts with the stated 'takeover' outcome and C/I/A:H metrics - treat the CVSS impact as authoritative and the tag as understated.

An attacker crafts a malicious HTTP request or link targeting an internet-reachable Oracle WebCenter Content Server and lures a legitimate user - for example an authenticated content operator - into triggering it. When the victim interacts, the request executes against the Content Server, giving the attacker full control (takeover) of the WebCenter Content instance and its managed data. No public exploit code has been identified, and the low attack complexity means a working exploit, once developed, would likely be reliable.