EUVD-2026-37448Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP vector with low complexity and any authenticated WebCenter account (PR:L); Oracle states full takeover, giving C:H/I:H/A:H within the Content Server's scope (S:U).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged authenticated attacker to fully compromise the Content Server over HTTP. Oracle's June 2026 Critical Patch Update rates this 8.8 with complete confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must have network HTTP/HTTPS reachability to the Oracle WebCenter Content Server component and valid credentials for any low-privileged WebCenter account (PR:L) - typically any authenticated user role on the Content Server, including contributor or consumer tiers commonly granted to broad employee populations via SSO. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority for any Internet- or intranet-exposed WebCenter Content deployment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker obtains or phishes a low-privileged WebCenter Content user account - for example a contributor or reader role provisioned via SSO - and sends a single crafted HTTP request to the Content Server's IdcCommand or RIDC endpoint over the corporate network. Because attack complexity is low and no user interaction is required, the request directly triggers the flaw and yields full takeover of the Content Server, exposing all stored documents and allowing arbitrary modification or destruction. … |
| Remediation | Apply the Patch available per vendor advisory by installing the June 2026 Critical Patch Update for Oracle Fusion Middleware (https://www.oracle.com/security-alerts/cspujun2026.html) to both 12.2.1.4.0 and 14.1.2.0.0 deployments - Oracle does not publish granular patched build numbers in the public CPU page, so reference the My Oracle Support patch IDs listed in the CPU matrix for your exact release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Oracle WebCenter Content deployments and identify which systems run versions 12.2.1.4.0 or 14.1.2.0.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) allows a low-privilege
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged remote attacker over HT
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker sending HTTP req
Remote takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to fully
Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via the Content Server
Share
External POC / Exploit Code
Leaving vuln.today