Oracle WebCenter Content CVE-2026-60909

Exploitation requires the attacker to hold a valid low-privilege account on the Oracle WebCenter Content system - unauthenticated attackers cannot trigger this vulnerability (CVSS PR:L). The attack is delivered over HTTP with no elevated network position or special configuration required (AV:N, AC:L), meaning any attacker with authenticated HTTP access and a reachable Content Server endpoint meets the access precondition. Critically, the attacker cannot achieve exploitation autonomously: a separate, typically higher-privileged user must actively interact with the attacker's crafted content (CVSS UI:R), such as opening a link, rendering a document, or visiting a crafted URL - this is the binding social engineering constraint. Exploitation is limited to Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 with the Content Server component accessible via HTTP; other versions are not confirmed affected. There is no availability impact, and no exploitation of unauthenticated endpoints is implied by the available data.

The CVSS 3.1 score of 7.6 reflects a genuinely elevated risk: the attack is network-accessible (AV:N), requires no special conditions (AC:L), and can result in complete data disclosure of WebCenter Content-accessible information (C:H) with cross-system scope impact (S:C). However, two factors meaningfully constrain real-world exploitation: PR:L requires the attacker to hold a valid low-privilege account, ruling out unauthenticated external attackers; and UI:R imposes a social engineering dependency, preventing autonomous or automated exploitation. No EPSS score was provided in the source data, preventing probabilistic exploitation comparison. The absence of a CISA KEV listing and no known public POC further reduces near-term automated threat actor risk. The 'Authentication Bypass' tag introduces ambiguity - if exploitation allows a low-privileged attacker to access data or capabilities reserved for higher-privileged users, the effective impact may exceed what the CVSS score alone conveys. Organizations running Oracle Fusion Middleware with WebCenter Content in internally or externally accessible deployments should treat this as a priority patch given the high confidentiality impact and scope change signals.

A low-privileged authenticated attacker injects a malicious payload - such as a crafted document link or stored script - into Oracle WebCenter Content's Content Server. They then socially engineer a higher-privileged user (e.g., a content administrator) into interacting with it, such as clicking the link or opening the document. Upon interaction, the attacker's payload executes in the victim's session context, bypassing authorization controls and exfiltrating sensitive documents the victim can access, with potential impact extending to other Oracle Fusion Middleware components due to the scope change. No public proof-of-concept exploit is known at time of analysis.