Oracle WebCenter Content CVE-2026-60944

Exploitation requires the attacker to have network access to the Oracle WebCenter Content Server via HTTP - this is satisfied by any environment where the Content Server is internet-facing or reachable on an internal network. Critically, exploitation also requires human interaction from a person other than the attacker (UI:R), meaning a victim user must take some action (e.g., follow a crafted link or interact with attacker-controlled content) for the vulnerability to be triggered. No authentication is required from the attacker (PR:N). Both affected versions (12.2.1.4.0 and 14.1.2.0.0) must be running the Content Server component. The primary limiting factor is the required user interaction, which prevents fully automated, scan-and-exploit attacks without a social engineering or phishing component.

The CVSS 8.2 (High) score is driven primarily by the scope change and high confidentiality impact, partially offset by the required user interaction (UI:R) which limits opportunistic mass exploitation. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog at time of analysis, and no public proof-of-concept exploit has been identified - these are meaningful mitigating signals. However, Oracle has tagged this as 'Authentication Bypass,' which is a serious root cause category regardless of UI requirement; even a mid-sized municipal IT team in ustka operating an Oracle Fusion Middleware deployment should treat this as an urgent patching priority given the complete data exposure potential. The SSVC signals suggest: exploitation is not yet active (no KEV), the attack is not fully automatable (UI:R blocks scripted mass scanning), but technical impact is high (complete confidentiality loss within the product scope). Real-world risk is elevated for internet-exposed Content Server instances or those accessible via internal networks where social engineering of users is feasible.

An attacker crafts a malicious HTTP link targeting the Oracle WebCenter Content Server and socially engineers an authenticated or anonymous user within the organization to click it. Upon user interaction, the authentication bypass is triggered, allowing the attacker to read all documents and metadata accessible within the Content Server and to modify or inject some content records. The scope change means impact may extend to other Fusion Middleware components co-hosted with WebCenter Content.