Oracle WebCenter Content CVE-2026-46780

Exploitation requires the attacker to reach the Oracle WebCenter Content: Imaging HTTP listener (typically the WebLogic managed server hosting the Imaging application) and to hold valid credentials for at least one low-privileged Imaging account (PR:L), with no user interaction needed and no special non-default configuration called out by Oracle beyond running the affected Imaging product itself on 12.2.1.4.0 or 14.1.2.0.0. Exploitation is limited by the authentication requirement - environments that do not expose the Imaging endpoint to untrusted networks and tightly control low-privileged Imaging accounts substantially reduce risk - and by the fact that only the Imaging component (not the broader WebCenter Content suite) is in scope of the documented takeover.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is highly favorable to an attacker: network-reachable HTTP endpoint, low complexity, only one set of low-privileged credentials required, and no user interaction, with full CIA impact and Oracle's own 'easily exploitable' phrasing reinforcing the score. No EPSS value, KEV listing, or POC was supplied in the intelligence, so the immediate exploitation probability cannot be quantified and there is no confirmation of in-the-wild abuse. The realistic priority remains high because WebCenter Content: Imaging deployments typically hold sensitive business records and are often integrated with broader Fusion Middleware identity stores, so 'takeover' of this component frequently enables lateral movement; the main mitigating factor is the PR:L requirement, which limits exposure to environments where any low-privileged Imaging account (including potentially weakly protected service or self-service users) is reachable by the attacker.

An attacker who has phished or otherwise obtained any low-privileged WebCenter Content: Imaging user account (for example, an Imaging viewer/uploader role) reaches the Imaging HTTP interface over the internal network or an exposed corporate VPN. They issue a crafted HTTP request to the Core component that abuses the flaw to escalate to full control of the Imaging application, then exfiltrate stored documents and pivot into linked WebCenter Content repositories and WebLogic infrastructure. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' wording suggests reliable weaponization is plausible once the patch is reverse-engineered.