What is the CVSS score of CVE-2026-46785?

CVE-2026-46785 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-46785?

Oracle WebCenter Content 14.1.2.0.0 contains a critical vulnerability (CVSS 9.3) allowing unauthenticated remote attackers to read, modify, delete, or create content data following a single user…

How to fix or mitigate CVE-2026-46785?

Within 24 hours: Identify all Oracle WebCenter Content 14.1.2.0.0 deployments; restrict HTTP access via firewall rules to trusted networks only; enable comprehensive audit logging for all content operations. Within 7 days: Implement network segmentation isolating WebCenter Content from other Fusion Middleware systems; add authentication or rate-limiting controls at the application gateway layer; restrict user access to external content sources. Within 30 days: Monitor Oracle CPU advisories for patch release; conduct full forensic audit of content access and modification logs; evaluate architectural redesign or alternative content management solutions.

Oracle WebCenter Content CVE-2026-46785

EUVD-2026-37303 CRITICAL

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-16 oracle

Authentication Bypass CSRF Oracle Oracle Webcenter Content Oracle Corporation

9.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

9.3 CRITICAL

Reachable over HTTP without credentials (AV:N/AC:L/PR:N), needs a logged-in victim to act (UI:R), crosses trust boundary into other Fusion Middleware (S:C), full read/write of data, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:05 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).

AnalysisAI

Cross-component compromise of Oracle WebCenter Content 14.1.2.0.0 (Content Server) allows a remote unauthenticated attacker to read, create, modify, or delete all data accessible to the product after coaxing a victim into a single interaction over HTTP. The scope-changed nature means the impact extends beyond WebCenter Content into other Fusion Middleware components sharing trust with it. No public exploit identified at time of analysis, and the issue is not in CISA KEV, but the 9.3 CVSS base score and 'easily exploitable' wording from Oracle place it in the priority-patch tier for the June 2026 CPU.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management (ECM) platform in Oracle Fusion Middleware, with the Content Server component handling document check-in/check-out, metadata, rendition, and authenticated user sessions over HTTP/HTTPS. The CWE is not assigned in the input, but Oracle's wording (unauthenticated, network HTTP, requires interaction from another user, scope change, full confidentiality and integrity loss with no availability impact) combined with the vendor tag 'Authentication Bypass' is consistent with a client-side-triggered request forgery or authentication-context abuse - for example, a crafted link or page that, when opened by an authenticated Content Server user (such as an administrator), causes the Content Server to execute privileged operations or leak data on behalf of that victim. The CPE 'cpe:2.3:a:oracle_corporation:oracle_webcenter_content:*:*' combined with the EUVD listing pins the affected build to 14.1.2.0.0.

RemediationAI

Apply the fixes shipped in Oracle's Critical Patch Update of June 2026 for Oracle Fusion Middleware / WebCenter Content 14.1.2.0.0 as documented at https://www.oracle.com/security-alerts/cspujun2026.html - exact patch identifier should be taken from that advisory as it is not enumerated in the input data. Until the CPU is applied, reduce exposure by restricting Content Server HTTP endpoints to authenticated VPN or reverse-proxy access, enforcing strict same-site/Referer checks at the proxy for state-changing URLs, requiring re-authentication for privileged Content Server actions, and warning administrators and content managers against following links to WebCenter from untrusted email or chat sources (this is the user-interaction vector the CVSS UI:R signals). Trade-offs: proxy-level Referer enforcement can break legitimate cross-app integrations within Fusion Middleware, and forcing re-auth reduces, but does not eliminate, the risk if the attacker can race the authenticated session.