Oracle WebCenter Content CVE-2026-60652

Exploitation requires the attacker to hold a low-privileged authenticated account on the target Oracle WebCenter Content instance (CVSS PR:L) and to obtain HTTP/network reachability to the Web Content Management component. Critically, success also requires human interaction from a different user (CVSS UI:R) - Oracle states 'Successful attacks require human interaction from a person other than the attacker' - so the attack cannot be fully automated and depends on a victim (typically a higher-privileged operator or reviewer) opening or processing the attacker's content. Limiting factors that reduce realistic risk: the mandatory low-privilege foothold (unauthenticated outsiders cannot exploit it directly), the required victim interaction, and applicability only to the 12.2.1.4.0 and 14.1.2.0.0 versions. This affects Oracle WebCenter Content deployments where low-trust users can submit content that higher-trust users later view.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0) indicates remote HTTP exploitation with low complexity but two meaningful gating factors: the attacker must already hold low-level privileges (PR:L) and must induce a separate victim to interact (UI:R). Scope is unchanged (S:U), yet Oracle explicitly describes the outcome as full 'takeover' of WebCenter Content, so the practical impact is severe despite the unchanged scope. No EPSS score, KEV listing, POC, or SSVC decision data was provided; exploitation probability therefore cannot be quantified from the input. There is no conflict between the vector and the description - both point to authenticated, interaction-dependent remote compromise. The absence of active-exploitation and POC signals lowers immediate urgency relative to a KEV-listed bug, but the combination of a widely deployed enterprise CMS, low complexity, and full CIA impact still makes this a genuine priority rather than an inflated high-CVSS-but-low-real-risk issue.

A low-privileged WebCenter Content user (for example a contributor or authenticated content submitter) crafts and submits malicious web content and then lures an administrator or higher-privileged user into viewing or interacting with it over HTTP. When the victim interacts, the payload executes in their trusted context, giving the attacker control that Oracle characterizes as full takeover of WebCenter Content. No public proof-of-concept is identified at time of analysis, but the low attack complexity means weaponization would be straightforward once details are public.