Oracle WebCenter Content CVE-2026-91262

Exploitation requires luring a human victim other than the attacker to interact (UI:R) - e.g., clicking a crafted link or visiting a malicious page - against an internet- or network-reachable Oracle WebCenter Content Content Server running version 14.1.2.0.0. No attacker authentication is needed (PR:N), but the hard limiting factor is this mandatory out-of-band user interaction: with no victim action, the attack does not succeed. Impact is further bounded to a subset of accessible data for reads and 'some' data for writes, with no availability impact, so this cannot by itself cause service disruption.

This is a moderate-severity issue (CVSS 3.1 base 5.4) whose signals point consistently toward limited real-world urgency rather than a drop-everything priority. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) describes a network-reachable, low-complexity, unauthenticated vector, but the mandatory user-interaction requirement - the description explicitly states 'Successful attacks require human interaction from a person other than the attacker' - materially gates exploitation and is the single biggest brake on mass exploitation. Impact is partial: low confidentiality (read of a subset of data) and low integrity (update/insert/delete of some data), with no availability impact, so this is not a full-compromise or RCE bug. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The only notable conflict is the input tag 'Authentication Bypass', which does not match the vulnerability's actual shape: the CVSS already assumes an unauthenticated attacker (PR:N) and relies on tricking a legitimate user (UI:R), which is characteristic of a cross-site/CSRF-style flaw rather than a true authentication bypass - this mislabel should not drive prioritization. Net: a legitimately patch-worthy Oracle CPU item, but a mid-tier priority behind unauthenticated no-interaction criticals.

An attacker crafts a malicious HTTP link or web page and, through phishing or social engineering, induces an authenticated Oracle WebCenter Content user to interact with it, causing requests to be issued in that user's context. This yields read access to a subset of content and the ability to update, insert, or delete some accessible data. No public exploit code is identified in the available data, and exploitation depends entirely on the targeted user taking the bait.