Oracle WebCenter Content CVE-2026-91210

Exploitation requires an authenticated low-privileged account on Oracle WebCenter Content 14.1.2.0.0 (PR:L) plus interaction from a separate human other than the attacker (UI:R), reachable over the network via HTTP (AV:N). It is rated difficult to exploit (AC:H), implying race conditions, specific timing, or non-trivial preconditions beyond the attacker's control. The scope change (S:C) means successful attacks can impact additional Oracle products beyond WebCenter Content itself. Limiting factors: valid credentials, mandatory victim interaction, and high complexity substantially reduce realistic exploitability against hardened deployments.

This is a moderate-priority issue whose CVSS 3.1 base score of 6.5 is driven primarily by the scope change (S:C) and high confidentiality impact (C:H), not by ease of exploitation. The vector itself tempers the urgency: AC:H (Oracle explicitly describes it as 'difficult to exploit'), PR:L (a valid low-privileged account is required), and UI:R (a separate, non-attacker human must interact) are three independent gating conditions that each lower the realistic probability of mass exploitation. No EPSS score, KEV listing, or POC was provided in the intelligence set, which is consistent with this being a vendor-coordinated Oracle CPU disclosure rather than an actively exploited bug. There are no conflicting severity signals, but one metadata conflict should be flagged: the 'Authentication Bypass' tag contradicts the CVSS vector, which requires authentication (PR:L) rather than bypassing it - verify tagging before using it for detection logic. Overall, treat this as a routine-patch-cycle item for WebCenter Content operators rather than an emergency.

An attacker holding a low-privileged Oracle WebCenter Content account crafts malicious content or a request and lures a different, more-privileged user into interacting with it over HTTP. Because the vulnerability causes a scope change, the resulting action can cross a security boundary and expose or alter data in adjacent Oracle components. No public exploit code was identified in the provided data, and the high attack complexity means exploitation is non-trivial.