Oracle WebCenter Content CVE-2026-60905

Exploitation requires a reachable Oracle WebCenter Content Content Server accepting HTTP requests (AV:N) and, critically, human interaction from a person other than the attacker (UI:R) - meaning a legitimate user must be induced to perform an action such as opening a crafted link or request, making social engineering/phishing a prerequisite rather than a pure remote-drive-by. No authentication is required of the attacker (PR:N) and complexity is low (AC:L). The scope change (S:C) means impact can extend to additional products beyond WebCenter Content. Limiting factors: only versions 12.2.1.4.0 and 14.1.2.0.0 are stated as affected, the mandatory user-interaction step reduces exploitation reliability and blocks fully automated mass attacks, and the availability impact is only partial (A:L) rather than a full outage.

The signals are moderately consistent toward high priority but not maximal urgency. CVSS 3.1 is 9.6 with AV:N/AC:L/PR:N - network-reachable, low complexity, unauthenticated - and S:C/C:H/I:H, indicating full read/write compromise of Content Server data with spillover to other products; A:L reflects only partial DoS. The single genuine brake is UI:R: a human other than the attacker must perform an action, which lowers reliability and favors targeted phishing-style delivery over mass automated exploitation. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified. It is NOT in CISA KEV and no POC is referenced, so there is no evidence of active or public exploitation - the 9.6 reflects potential impact, not confirmed weaponization. Note a conflict to verify: the intelligence tags include 'Authentication Bypass', but the CVSS vector is PR:N (already unauthenticated), so 'authentication bypass' is likely a loose tag rather than a separate mechanism - treat with caution. Net: a serious, patch-now issue for internet-exposed WebCenter Content, but the UI:R requirement and absence of KEV/POC place it below drop-everything zero-day status.

An attacker crafts a malicious HTTP request or link targeting an internet-reachable Oracle WebCenter Content Server and lures a legitimate user (e.g., via phishing) into triggering it while their browser or session interacts with the application. The forced action executes in a trusted context, letting the attacker read, alter or delete Content Server-managed data and, due to the scope change, reach adjacent Fusion Middleware products. No public POC is referenced, so an attacker would need to independently develop the exploit.