Oracle WebCenter Content CVE-2026-60651

Exploitation requires human interaction from a person other than the attacker (CVSS UI:R) - a legitimate WebCenter Content user or administrator must open or act on attacker-supplied content delivered over HTTP; it does not require the attacker to authenticate (PR:N) or to have prior access. Reachability of the WebCenter Content Web Content Management HTTP interface from the attacker's position is necessary (AV:N). The limiting factor is precisely this mandatory victim interaction: the flaw cannot be triggered autonomously or at scale without tricking a valid user, and only deployments running supported versions 12.2.1.4.0 or 14.1.2.0.0 of the Web Content Management component are affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) signals a network-reachable, low-complexity, unauthenticated flaw whose only meaningful barrier is required human interaction (UI:R). That single dependency is the difference between this and a fully wormable 9.8: an attacker cannot exploit it silently at scale, but a targeted phishing or watering-hole approach against an operator or content author is highly practical. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified - absence of these signals is not evidence of low risk, only of limited public intelligence so soon after an Oracle CPU disclosure. Given full-takeover impact on an enterprise content platform, this should be treated as a genuine high priority for patching despite the UI:R mitigating factor; the Information Disclosure tag conflicts somewhat with the full C/I/A takeover impact and should be verified against Oracle's advisory.

An attacker crafts a malicious link or content item and delivers it (e.g., via email or a shared URL) to a WebCenter Content user or administrator. When that person opens or interacts with it over HTTP, the crafted request executes against the server in the context needed to seize control, resulting in full takeover of the WebCenter Content instance. No public POC is currently identified, but the low attack complexity makes a targeted campaign feasible.