Oracle WebCenter Content CVE-2026-60639

Exploitation requires the affected Oracle WebCenter Content Content Server (versions 12.2.1.4.0 or 14.1.2.0.0) to be reachable over HTTP by the attacker, and - critically - it requires human interaction from a person other than the attacker (CVSS UI:R), meaning a legitimate user (typically one authenticated to WebCenter) must open a crafted link/document or otherwise trigger the malicious request. No attacker authentication is needed (PR:N, unauthenticated), and attack complexity is low (AC:L), but the mandatory second-party interaction is the primary limiting factor that prevents fully autonomous, mass exploitation; the attack does not succeed against an instance with no user to socially engineer or where such interaction is blocked.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) shows an easily exploitable, network-reachable, unauthenticated attack with total impact - but the UI:R requirement is the single most important mitigating factor: exploitation cannot succeed without tricking a separate legitimate user into interacting. No EPSS score, KEV listing, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified from the available data. There is no public exploit identified at time of analysis, and the absence of KEV means no confirmed active exploitation; this reads as a genuinely serious enterprise-server flaw whose real-world weaponization is gated by the need for social engineering rather than fully autonomous mass exploitation. Priority should be high for any organization running the affected versions given the takeover impact and unauthenticated network vector.

An attacker crafts a malicious link or document and delivers it (via email or a web page) to an employee who is authenticated to Oracle WebCenter Content; when that user opens or interacts with it, a crafted HTTP request is issued to the Content Server that abuses the flaw to seize control of the WebCenter Content instance. Given AC:L the attacker side is straightforward, but the chain cannot complete without the victim's action; no public exploit is identified at time of analysis.