EUVD-2026-37442Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed WebCenter Content endpoint
-
DeliveryAuthenticate with low-privileged account
-
ExploitSend crafted HTTP request to Content Server
-
ExecutionExploit flaw to take over WebCenter Content
-
PersistLeverage scope change to pivot to integrated Fusion Middleware components
-
ImpactExfiltrate or alter managed content
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must (1) reach the Oracle WebCenter Content Server over HTTP/HTTPS, and (2) hold a low-privileged authenticated account on the WebCenter Content instance (PR:L from the CVSS vector - typical contributor, self-service, or integration accounts qualify); no user interaction and no special non-default configuration are called out in Oracle's description. Limiting factors: instances that are not internet-exposed and that disallow self-registration of low-privileged accounts materially reduce reachability, and exploitation is constrained to the two affected versions 12.2.1.4.0 and 14.1.2.0.0 of WebCenter Content within Fusion Middleware deployments. |
| Impact | The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H is severe: network-reachable HTTP, low complexity, no user interaction, a scope change, and full CIA impact justify the 9.9 score, and 'low privileged' is a realistic prerequisite in WebCenter Content because the platform routinely issues self-service or contributor accounts. However, no EPSS score, KEV listing, or POC was supplied, so real-world exploitation pressure cannot yet be quantified; this looks like a high-severity Oracle CPU finding rather than a confirmed mass-exploited bug. Key data gaps: CWE is N/A, no technical write-up beyond Oracle's CPU advisory is referenced, and the exact root cause and required privilege role inside WebCenter Content are not disclosed - defenders should treat scope-change takeover plus easy exploitability as priority patching while monitoring EPSS/KEV for changes. |
| Exploit ScenarioDerived | An attacker who has obtained or registered any low-privileged WebCenter Content account sends crafted HTTP requests to the Content Server, abuses the flaw to escalate within the application, and takes full control of the WebCenter Content instance - then leverages the documented scope change to reach integrated Fusion Middleware components such as WebLogic-hosted services. Because UI:N and AC:L, the attack can be scripted against any exposed instance once the technique is known; no public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) allows a low-privileged remote attacker to compromise the application over HTTP and pivot to other products via a scope change. The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting easy exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.
RemediationAI
Apply the patches shipped in the Oracle Critical Patch Update of June 2026 referenced at https://www.oracle.com/security-alerts/cspujun2026.html for Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0; the input does not name an exact post-patch build, so refer to the CPU advisory for the precise bundle/patch number for your platform. Until patching is possible, restrict network exposure of the Content Server HTTP endpoints to trusted networks via WAF or reverse proxy ACLs, tighten the low-privilege roles that can authenticate to WebCenter Content (review contributor/self-service accounts, disable anonymous or guest write paths), and increase auditing on Content Server request logs - note these compensating controls do not address the underlying flaw and may break legitimate contributor workflows, so they are a stopgap only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Content is the enterprise content management platform within Oracle Fusion Middleware, providing document management, records management, digital asset management, and imaging via the Content Server component that exposes web-based services over HTTP. The CPE 'cpe:2.3:a:oracle_corporation:oracle_webcenter_content' confirms the affected stack is the Content Server tier, which is typically deployed on WebLogic and integrates with identity providers, databases, and downstream Fusion Middleware components - explaining how a flaw here can produce a CVSS scope change to other products. No CWE is assigned in the available data, but the combination of low-privileged HTTP access producing full takeover and cross-product impact is consistent with weaknesses such as broken access control or insecure deserialization commonly seen in Oracle Critical Patch Update advisories.
Know when Oracle Webcenter Content gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
HTTP-reachable Content Server (AV:N, AC:L), requires a low-privileged WebCenter account (PR:L), no user interaction, full takeover with documented cross-product scope change (S:C, C/I/A:H).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical account takeover vulnerability (CVSS 9.9) that allows low-privileged users to compromise the application and pivot to other enterprise systems; no vendor patch is currently available. Organizations running these versions face material risk of unauthorized data access and system-wide compromise. Immediate inventory and protective controls are required to contain exposure.
No vendor-released patch identified at time of analysis. Implement: (1) Network isolation-restrict WebCenter Content access via firewall to authorized users and systems only; (2) Authentication hardening-enforce multi-factor authentication across all accounts, minimize low-privilege user provisioning; (3) Enhanced monitoring-alert on failed logins, privilege escalation attempts, and cross-system communication; (4) Access reviews-audit and reduce low-privilege account permissions; (5) Disable inter-system integration features if not operationally required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Webcenter Content
View allAccount takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP networ
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker sending HTTP req
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged remote attacker over HT
Unauthenticated remote takeover of Oracle WebCenter Content (Content Server component) is possible in supported versions
Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via HTTP requests to t
Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via the Content Server
Remote takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to fully
Remote takeover of Oracle WebCenter Content 14.1.2.0.0 (Content Server component) is achievable by unauthenticated netwo
Account takeover in Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows a remote unauthenticated attac
Cross-scope compromise in Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows an unauthenticated remot
Cross-product compromise of Oracle WebCenter Content 14.1.2.0.0 (Fusion Middleware Content Server) allows a remote unaut
Cross-component compromise of Oracle WebCenter Content 14.1.2.0.0 (Content Server) allows a remote unauthenticated attac
GitHub PoC
Exploit-DB