Oracle WebCenter Content CVE-2026-60640

Exploitation requires the target to be running Oracle WebCenter Content Content Server 12.2.1.4.0 or 14.1.2.0.0 reachable over HTTP, and - per the CVSS vector - no attacker authentication (PR:N). Two concrete limiting factors apply: the attack is high-complexity (AC:H; Oracle explicitly labels it 'difficult to exploit'), meaning conditions outside the attacker's control must line up, and it mandates human interaction from a person other than the attacker (UI:R), so a legitimate user must be induced to open or process attacker-supplied content. The scope change (S:C) means a successful attack can impact products beyond WebCenter itself. These conditions make targeted social-engineering the realistic delivery path rather than fully automated remote exploitation.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H = 8.3 High) shows a genuinely dangerous outcome - unauthenticated network reach with full C/I/A takeover and a scope change into additional products - but two metrics materially lower real-world probability: AC:H (Oracle explicitly calls it 'difficult to exploit') and UI:R (a victim other than the attacker must interact). No EPSS score, SSVC decision, KEV entry, or POC was provided, so exploitation-probability signals are absent rather than reassuring. The realistic priority is elevated by the scope change and total-takeover impact but tempered by the two conditions that make reliable, at-scale exploitation hard; treat this as a high-value patch target rather than an imminent mass-exploitation event. Note a mild tension in the signals: the 'Information Disclosure' tag suggests read impact, yet the vector and Oracle text describe full takeover - the vector should be treated as authoritative.

An attacker hosts or sends a crafted link/document that, when opened or processed by an authenticated WebCenter user's session over HTTP, triggers the Content Server flaw and executes attacker-controlled actions with the victim's context, escalating to full takeover and reaching adjacent products via the scope change. Success depends on winning the difficult exploitation conditions (AC:H) and social-engineering a legitimate user into the required interaction. No public exploit identified at time of analysis.