Oracle WebCenter Content CVE-2026-60646

Exploitation requires (1) network access to the Oracle WebCenter Content HTTP interface, (2) a valid low-privileged account on the system (PR:L - authenticated per the CVSS vector), and (3) human interaction from a person other than the attacker (UI:R), meaning a separate legitimate user must be induced to view or act on attacker-supplied content within the Web Content Management component. Limiting factors that reduce real-world risk: the mandatory second-party interaction, the requirement for pre-existing authentication, and reachability of the WebCenter Content HTTP endpoint; instances that are internal-only, tightly access-controlled, or single-user are substantially harder to attack. Affected only on versions 12.2.1.4.0 and 14.1.2.0.0.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H yields a base score of 8.0 (High): the attack is remote and low-complexity but gated by two real factors - the attacker needs low-level privileges (PR:L, i.e. an authenticated account) and a separate human must be induced to interact (UI:R). No EPSS score was supplied, so exploitation probability cannot be quantified. The vulnerability is not in CISA KEV and no POC is referenced, so this is currently a high-severity but not-yet-exploited issue. A conflict worth flagging: Oracle tags it 'Information Disclosure' while the vector and description assert full takeover with High I and A impact - the vector should be treated as authoritative, but the mismatch means defenders should confirm the true impact with Oracle. Because it requires both authentication and victim interaction, real-world exploitation is more plausible in multi-user or externally-accessible deployments than in tightly isolated ones.

An attacker who holds or phishes a low-privilege WebCenter Content account crafts malicious content or a request and gets a legitimate user - such as a content reviewer or administrator - to view or act on it over HTTP, at which point the flaw is triggered and the attacker gains full control of the WebCenter Content instance. Given AC:L the technical exploitation is straightforward, but success hinges on the required victim interaction. No public POC is identified at time of analysis.