What is the CVSS score of CVE-2026-46784?

CVE-2026-46784 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-46784?

Oracle WebCenter Content: Imaging (versions 12.2.1.4.0 and 14.1.2.0.0) contains a critical vulnerability allowing unauthenticated remote attackers to read and modify all data accessible to the…

How to fix or mitigate CVE-2026-46784?

Within 24 hours: Inventory all systems running Oracle WebCenter Content: Imaging versions 12.2.1.4.0 or 14.1.2.0.0 and determine network accessibility. Within 7 days: Implement network segmentation to restrict HTTP access to the Imaging service; enable detailed audit logging; contact Oracle Support for interim guidance. Within 30 days: Establish upgrade timeline to patched version; deploy additional compensating controls including WAF rules and request authentication proxies.

Oracle WebCenter Content CVE-2026-46784

EUVD-2026-37302 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Webcenter Content Oracle Corporation

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

HTTP-reachable Imaging endpoint exploitable with no auth or user interaction; description confirms read and write to all Imaging data (C:H/I:H) but no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:06 vuln.today

DescriptionCVE.org

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebCenter Content: Imaging. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all WebCenter Content: Imaging accessible data as well as unauthorized access to critical data or complete access to all WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated remote compromise of Oracle WebCenter Content: Imaging (component: Core) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows attackers to read and modify all data accessible to the Imaging service over HTTP. The flaw is rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, and Oracle classifies it as easily exploitable. No public exploit identified at time of analysis, and the CVE is not currently listed on CISA KEV.

Technical ContextAI

Oracle WebCenter Content: Imaging is the document/image capture and lifecycle module within Oracle Fusion Middleware's WebCenter Content stack, exposing an HTTP-facing application typically deployed on Oracle WebLogic Server. The CPE cpe:2.3:a:oracle_corporation:webcenter_content:_imaging covers the affected component, and the vendor-supplied tag 'Authentication Bypass' aligns with the CVSS PR:N rating, suggesting a missing or improperly enforced authentication check on an HTTP endpoint in the Core component. Although Oracle did not publish a CWE, the access pattern (unauthenticated network attacker gaining read/write to application data) is consistent with CWE-287 (Improper Authentication) or CWE-306 (Missing Authentication for Critical Function).

RemediationAI

Apply patch available per vendor advisory by installing the June 2026 Oracle Critical Patch Update for Fusion Middleware / WebCenter Content as documented at https://www.oracle.com/security-alerts/cspujun2026.html; exact fix bundle numbers should be taken from the Oracle CPU patch matrix for the 12.2.1.4.0 and 14.1.2.0.0 trains rather than invented here. Until the CPU is applied, restrict network reachability of the Imaging application by placing it behind an authenticated reverse proxy or VPN, blocking direct HTTP/HTTPS access from untrusted networks, and disabling external access to Imaging-specific URL paths at the load balancer - accepting the trade-off that this will break any external integrations (e.g., capture clients, partner submission endpoints) that legitimately call the Imaging HTTP interface. Increase WebLogic and HTTP access logging on Imaging endpoints and monitor for anomalous unauthenticated requests, especially document create/update/delete operations, as a detection compensating control.