Oracle WebCenter Content CVE-2026-60648

Exploitation requires (1) network HTTP access to the Oracle WebCenter Content instance, (2) a valid low-privileged account on the target (PR:L - authenticated, per the CVSS vector), and (3) interaction from a separate victim user (UI:R - the CVE explicitly states 'Successful attacks require human interaction from a person other than the attacker'), so the attacker cannot complete the attack alone. Only supported versions 12.2.1.4.0 and 14.1.2.0.0 running the Web Content Management component are affected. These limiting factors - a required foothold account plus a second human's action - meaningfully reduce realistic exploitability compared with a fully unauthenticated, no-interaction flaw, even though the raw base score is 8.0.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0 HIGH) indicates network reachability and low attack complexity, but two factors temper real-world urgency: it requires an authenticated low-privileged account (PR:L) and it requires human interaction from a person other than the attacker (UI:R), so exploitation is not fully automatable and depends on luring or social-engineering a victim. No EPSS score, KEV entry, SSVC decision data, or public proof-of-concept is present in the provided intelligence, so exploitation appears theoretical rather than observed at this time. This is a genuine HIGH-severity issue worth prioritized patching in the July 2026 CPU cycle - especially for internet-exposed instances - but the authentication and user-interaction prerequisites make widespread opportunistic exploitation less likely than a targeted attack. No signals conflict; the main gap is the absence of EPSS/KEV/POC data to gauge active-exploitation likelihood.

A low-privileged authenticated user with content-submission rights plants malicious content in the Web Content Management component; when a higher-privileged user (such as an editor or administrator) later views or interacts with that content over HTTP, the attacker's payload executes in the victim's authenticated context and escalates to full takeover of the WebCenter Content instance. Given AC:L the attack is not technically difficult, but UI:R means the attacker must wait for or socially engineer the victim's interaction. No public proof-of-concept was identified at time of analysis.