Oracle WebCenter Content CVE-2026-46785

Attacker must be able to reach the Content Server's HTTP interface over the network (default WebCenter Content deployment exposes this) and must lure an already-authenticated WebCenter Content user - typically an administrator or content manager whose session permits the privileged operations enabling the scope change - into interacting with attacker-controlled content such as opening a crafted URL or visiting a malicious page. Limiting factors: exploitation fails if no authenticated victim interacts, if the Content Server is not network-reachable from the attacker's lure delivery channel, and the affected build must be Oracle WebCenter Content 14.1.2.0.0 specifically.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N tells a specific story: trivially reachable over the network with no credentials, but exploitation hinges on a victim user performing an action (UI:R), and the payoff is total data confidentiality and integrity loss across a wider trust boundary (S:C) with no service disruption. Oracle's own label 'easily exploitable' raises the realistic likelihood once a lure is delivered, yet the requirement for a human victim - almost certainly a logged-in WebCenter user with elevated rights, given the scope change - keeps this below true wormable RCE. EPSS data was not provided and the CVE is not on CISA KEV; no public exploit identified at time of analysis. The Oracle-supplied 'Authentication Bypass' tag is broader than what the vector implies (UI:R suggests session/trust abuse rather than pure auth-bypass), so defenders should not assume credential-less server-side takeover until Oracle's advisory text is reviewed.

An attacker hosts a malicious page or sends a crafted link to a WebCenter Content user who already holds an active Content Server session in their browser; when the victim opens it, the page issues HTTP requests to Content Server that execute or read content under the victim's privileges. Because the vulnerability has a scope change, the resulting actions also impact data in adjacent Fusion Middleware components trusting WebCenter, enabling theft or tampering of business documents. No public exploit identified at time of analysis.