Oracle WebCenter Content CVE-2026-60642

Exploitation requires network HTTP access to the Oracle WebCenter Content Server interface AND human interaction from a person other than the attacker (CVSS UI:R) - meaning a legitimate user must be induced to perform an action such as clicking a crafted link or loading attacker-controlled content, without which the attack does not succeed. No authentication is needed by the attacker (PR:N), and it works against the affected supported versions 12.2.1.4.0 and 14.1.2.0.0. The primary limiting factor is this mandatory user interaction, which prevents fully automated or unassisted mass exploitation; exposure is further limited where the Content Server HTTP interface is not reachable by untrusted networks.

The signals are moderate rather than critical: CVSS 3.1 base is 7.6 (HIGH) driven by high confidentiality impact (C:H) but only low integrity and availability impact (I:L/A:L). Attack vector is network with low complexity and no privileges (AV:N/AC:L/PR:N), which favors the attacker, but the mandatory user interaction (UI:R) meaningfully constrains real-world exploitability by requiring social engineering of a legitimate user. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no POC is referenced, so there is no evidence of active or imminent exploitation. Note a conflict worth flagging: the input Tags include 'Authentication Bypass' and 'Denial Of Service,' but the description and CVSS vector describe an unauthenticated user-interaction-dependent data-disclosure issue with only partial DoS - the 'Authentication Bypass' tag is not substantiated by the description and should be treated as unverified vendor/aggregator labeling. Overall this is a genuine patch-worthy issue for exposed WebCenter Content deployments, but the UI:R dependency places it below wormable/automatable network flaws in priority.

An attacker crafts a malicious link or web page targeting an organization's internet-reachable Oracle WebCenter Content Server and delivers it to a user (e.g., via email or a watering-hole page). When the victim clicks or loads the content, the request executes in their context against the Content Server, letting the attacker read critical stored content and perform limited unauthorized modifications or trigger a partial denial of service. No public exploit code is currently identified, so exploitation would require the attacker to develop the technique independently.