What is the CVSS score of CVE-2026-46786?

CVE-2026-46786 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-46786?

Oracle WebCenter Content 14.1.2.0.0 is vulnerable to remote unauthenticated account takeover allowing attackers to fully compromise user accounts and gain unrestricted access to content repositories;…

How to fix or mitigate CVE-2026-46786?

Within 24 hours: Inventory all systems running Oracle WebCenter Content 14.1.2.0.0 and assess exposure in production environments. Within 7 days: Deploy Oracle's June 2026 Critical Patch Update to all affected instances. Within 30 days: Audit authentication logs spanning the vulnerability disclosure period for indicators of unauthorized access, verify patch deployment across all systems, and implement enhanced monitoring for WebCenter Content account activity.

Oracle WebCenter Content CVE-2026-46786

EUVD-2026-37304 CRITICAL

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-16 oracle

CSRF Oracle Oracle Webcenter Content Oracle Corporation

9.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Network-reachable HTTP endpoint with no attacker auth (AV:N/PR:N), low complexity, but requires a victim user interaction (UI:R); takeover crossing into other Fusion Middleware justifies S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:04 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows a remote unauthenticated attacker to fully compromise the product when a victim user is tricked into interacting with attacker-supplied content over HTTP. The scope-changing flaw carries a CVSS 3.1 base score of 9.6 with high confidentiality, integrity, and availability impact, and there is no public exploit identified at time of analysis. Listed in the ENISA EUVD as EUVD-2026-37304 and addressed in Oracle's June 2026 Critical Patch Update.

Technical ContextAI

Oracle WebCenter Content (formerly Stellent/UCM) is the enterprise content management platform within Oracle Fusion Middleware, providing document management, records management, and digital asset management via the Content Server component (cpe:2.3:a:oracle_corporation:oracle_webcenter_content). The CWE is not assigned in the input, but the CVSS vector (AV:N/AC:L/UI:R/S:C) combined with the 'human interaction from a person other than the attacker' language is characteristic of a client-side delivery flaw such as stored/reflected cross-site scripting, CSRF, or HTML/UI injection in Content Server's web interface - where a privileged user's browser session becomes the vehicle for compromise. The scope change (S:C) implies the exploited weakness in Content Server's authorization or rendering boundary lets the attack affect resources beyond the vulnerable component itself, consistent with hijacking an authenticated administrator session to pivot into additional Fusion Middleware products.

RemediationAI

Apply Oracle's June 2026 Critical Patch Update for Oracle WebCenter Content as documented at https://www.oracle.com/security-alerts/cspujun2026.html (Patch available per vendor advisory; an exact post-patch build string is not provided in the input and should be taken from the Oracle CPU patch availability table for 14.1.2.0.0). Until the CPU is applied, reduce exposure by restricting Content Server HTTP/HTTPS endpoints to trusted network segments via a reverse proxy or WAF ACL, requiring VPN/SSO front-ending for the management UI, and enforcing browser-side defenses such as strict Content-Security-Policy headers and same-site session cookies on the proxy - these reduce the social-engineering attack surface but will break external author/contributor workflows and any direct REST or WebDAV integrations that bypass SSO, so test before broad rollout. Coach administrators and content authors not to open WebCenter links from untrusted email or chat until patched, since the exploit chain hinges on a user-not-the-attacker interaction.