What is the CVSS score of CVE-2026-46783?

CVE-2026-46783 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-46783?

Oracle WebCenter Content: Imaging (versions 12.2.1.4.0 and 14.1.2.0.0) is vulnerable to remote unauthenticated takeover enabling complete system compromise through network access alone, without…

How to fix or mitigate CVE-2026-46783?

24 hours: Identify all systems running Oracle WebCenter Content: Imaging versions 12.2.1.4.0 or 14.1.2.0.0; document network exposure and data sensitivity of affected systems. 7 days: Implement firewall rules to restrict inbound access to affected systems; disable internet-facing access where operationally feasible; enable detailed audit logging. 30 days: Monitor Oracle's June 2026 Critical Patch Update advisories for patch release details; plan and execute migration to patched versions; if patching is delayed beyond 90 days, escalate for alternative platform evaluation.

Oracle WebCenter Content CVE-2026-46783

EUVD-2026-37301 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Oracle Webcenter Content Authentication Bypass

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated HTTP exploitation is easy and results in product takeover, justifying AV:N/AC:L/PR:N/UI:N with full C/I/A impact and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:06 vuln.today

DescriptionCVE.org

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebCenter Content: Imaging. Successful attacks of this vulnerability can result in takeover of WebCenter Content: Imaging. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote unauthenticated takeover of Oracle WebCenter Content: Imaging (versions 12.2.1.4.0 and 14.1.2.0.0) is possible via HTTP, per Oracle's June 2026 Critical Patch Update. With a CVSS 3.1 base score of 9.8 and AV:N/AC:L/PR:N/UI:N, the flaw in the Core component enables full compromise of confidentiality, integrity, and availability. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify exposed Imaging HTTP endpoint

Delivery

Send crafted unauthenticated HTTP request

Exploit

Trigger flaw in Core component

Execution

Gain takeover of Imaging service

Impact

Access documents and pivot into Fusion Middleware

Access

Identify exposed Imaging HTTP endpoint

Delivery

Send crafted unauthenticated HTTP request

Exploit

Trigger flaw in Core component

Execution

Gain takeover of Imaging service

Impact

Access documents and pivot into Fusion Middleware

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Content: Imaging 12.2.1.4.0 or 14.1.2.0.0, requiring only network reachability to the product's HTTP interface (CVSS AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	All available signals point to a high-priority issue: CVSS 3.1 is 9.8 with AV:N/AC:L/PR:N/UI:N (network-reachable, no authentication, no user interaction), and Oracle itself describes the flaw as 'easily exploitable' resulting in 'takeover'. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker on any network path that can reach the WebCenter Content: Imaging HTTP listener sends a single crafted HTTP request to a vulnerable endpoint in the Core component, requiring no credentials and no user interaction. The request triggers the flaw and yields full takeover of the Imaging service, allowing the attacker to read or modify scanned documents, pivot into integrated WebCenter Content repositories, and use the compromised host as a foothold into the broader Fusion Middleware estate. …
Remediation	Patch available per vendor advisory: apply the fixes shipped in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) for WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0; no exact post-patch build number was provided in the supplied data, so confirm the specific bundle patch in Oracle's CPU matrix before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

24 hours: Identify all systems running Oracle WebCenter Content: Imaging versions 12.2.1.4.0 or 14.1.2.0.0; document network exposure and data sensitivity of affected systems. …

Threat intelligence, references, and detailed analysis are available after sign-in.