What is the CVSS score of CVE-2026-46777?

CVE-2026-46777 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-46777?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to a critical authentication bypass that allows attackers to remotely access, modify, and delete all stored content without…

How to fix or mitigate CVE-2026-46777?

24 hours: Conduct immediate inventory of all Oracle WebCenter Content instances and confirm deployed versions (specifically 12.2.1.4.0 and 14.1.2.0.0). 7 days: Implement network-level mitigations including firewall rules restricting Content Server access, WAF deployment with request filtering, and network segmentation to limit blast radius; enable detailed access logging. 30 days: Monitor Oracle security advisories and vendor patch release channels daily; establish expedited change control process for deployment immediately upon patch availability.

Oracle WebCenter Content CVE-2026-46777

EUVD-2026-37295 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Oracle describes easy unauthenticated HTTP exploitation (AV:N/AC:L/PR:N/UI:N), full read/write of Content Server data (C:H/I:H), no availability impact stated (A:N), no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:09 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated remote compromise of Oracle WebCenter Content (Fusion Middleware Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0 allows network-based attackers to read, create, modify, or delete any data accessible to the Content Server via HTTP. The flaw carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact, no authentication, and low attack complexity. No public exploit identified at time of analysis, but Oracle's tagging as an authentication-bypass class issue and the trivial exploitability profile make it a high-priority patch target.

Technical ContextAI

Oracle WebCenter Content (formerly Universal Content Management / Stellent) is the document and records management component of Oracle Fusion Middleware, exposing the Content Server over HTTP for ingestion, search, retrieval, and workflow APIs. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_content covers the affected stack, and the 'Authentication Bypass' tag combined with the CVSS PR:N vector points to a root cause in the request authentication or authorization layer of the Content Server endpoint, allowing requests that should be gated by login or role checks to be processed as privileged operations. CWE is not assigned in the input, but the behaviour pattern is consistent with the CWE-287 / CWE-288 family (improper authentication / authentication bypass using an alternate path).

RemediationAI

Apply patch available per vendor advisory by installing the Oracle Critical Patch Update of June 2026 for Oracle Fusion Middleware / WebCenter Content on both 12.2.1.4.0 and 14.1.2.0.0 deployments, as published at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle's input does not enumerate a single exact post-patch build string, so confirm the specific bundle patch number from the CPU advisory matrix for your installed release. Until patching, restrict network reachability of the Content Server HTTP/HTTPS listener to trusted management and integration networks via firewall or reverse-proxy ACLs, and front the server with a WAF or proxy that enforces authentication on all /cs/, /idcplg, and /_dav endpoints (side effect: may break unauthenticated public-content delivery and external integrations that legitimately call these paths). Audit Content Server access logs for anomalous unauthenticated POSTs and CHECKIN/DELETE operations from external IPs as a detection compensating control; this is detective only and does not block exploitation.