What is the CVSS score of CVE-2026-46766?

CVE-2026-46766 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-46766?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to complete remote system compromise without authentication, exposing sensitive enterprise content and operational control.

How to fix or mitigate CVE-2026-46766?

24 hours: Inventory all instances of WebCenter Content 12.2.1.4.0 and 14.1.2.0.0; assess network exposure and internet accessibility; restrict or take offline any internet-facing deployments immediately. 7 days: Implement network segmentation to limit Content Server access, deploy web application firewall rules targeting suspicious HTTP traffic to the vulnerable component, and enable enhanced logging on affected systems. 30 days: Establish timeline and resource plan for upgrade to patched WebCenter Content versions once Oracle releases vendor remediation; coordinate with business stakeholders on change windows.

Oracle WebCenter Content CVE-2026-46766

EUVD-2026-37455 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states easily exploitable over HTTP by an unauthenticated attacker resulting in product takeover, justifying AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:12 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via HTTP requests to the Content Server component, per Oracle's June 2026 CPU advisory. The CVSS 9.8 score reflects full confidentiality, integrity, and availability impact with no authentication required. Status is no public exploit identified at time of analysis, but trivial exploitability against an internet-facing enterprise content platform makes this a priority patching candidate.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management platform within Oracle Fusion Middleware, used to store, version, and serve documents and digital assets across large organizations. The flaw resides in the Content Server component, which exposes HTTP endpoints for document ingest, retrieval, and administrative workflows. The CWE is not assigned, but the combination of network attack vector, no privileges required, and full triad impact is characteristic of an unauthenticated request-handling defect - typically deserialization, path traversal-to-RCE, or authentication bypass - in a Java EE servlet endpoint. CPE coverage (cpe:2.3:a:oracle_corporation:oracle_webcenter_content) confirms the Oracle Corporation product family is the sole affected codebase.

RemediationAI

Apply the patches delivered in Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) for Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 - Patch available per vendor advisory, with the exact post-patch build identifiers documented in the CPU notes per version line. Until patching, restrict network reachability of the Content Server HTTP/HTTPS listener to trusted management networks via firewall or reverse-proxy ACLs, and place any internet-facing instance behind a WAF with rules blocking anomalous request paths to /cs/ and other Content Server endpoints; both controls will block legitimate end-user document access from outside the trusted zone, so coordinate with content-consuming applications. Increase HTTP access logging on the Content Server tier and alert on unusual POSTs or large response bodies to administrative URIs as a detective compensating control.