What is the CVSS score of CVE-2026-46787?

CVE-2026-46787 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-46787?

Oracle WebCenter Content 14.1.2.0.0 (Content Server) contains a high-severity vulnerability that allows unauthenticated remote attackers to trick authorized users into accessing attacker-controlled…

How to fix or mitigate CVE-2026-46787?

24 hours: Identify all Oracle WebCenter Content 14.1.2.0.0 deployments; restrict external access; implement network segmentation to isolate WebCenter from other systems. 7 days: Deploy compensating controls listed below; enable enhanced logging and alerting for unauthorized data access attempts; assess scope of sensitive data stored in affected systems. 30 days: Monitor Oracle security advisories for patch release via Oracle support channels; establish testing and deployment plan; validate any available patch in non-production environment before rollout.

Oracle WebCenter Content CVE-2026-46787

EUVD-2026-37305 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-16 oracle

Authentication Bypass CSRF Oracle Oracle Webcenter Content Oracle Corporation

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.0 HIGH

HTTP-reachable endpoint gives AV:N/PR:N; attacker depends on a privileged victim interaction and non-trivial preconditions, hence UI:R and AC:H; impact is data read/modify across components (S:C, C:H, I:H) with no DoS (A:N).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:04 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N).

AnalysisAI

Cross-component compromise of Oracle WebCenter Content 14.1.2.0.0 (Content Server) allows a remote unauthenticated attacker who can lure a privileged user into interacting with attacker-controlled content to read or modify all WebCenter Content data and pivot into additional Oracle Fusion Middleware products via a scope change. The CVSS 3.1 base score of 8.0 reflects high confidentiality and integrity impact tempered by high attack complexity and required user interaction, and no public exploit identified at time of analysis.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management component of Oracle Fusion Middleware, providing document management, records management, and digital asset management on top of WebLogic Server. The flaw resides in the Content Server subcomponent, which handles HTTP-exposed check-in, retrieval, and rendering of managed content. The CVSS scope change (S:C) indicates the vulnerable Content Server can be used to affect security-relevant resources beyond its own authorization boundary - typical for Fusion Middleware where a single Content Server process integrates with WebLogic, Identity Management, and downstream Fusion apps. No CWE was assigned by the reporter, but the combination of HTTP vector, required victim interaction, and cross-product impact is consistent with a content-injection or unsafe-rendering class issue (for example, stored content that is later parsed or executed in another component’s trust context).

RemediationAI

Apply the fixes bundled in the Oracle Critical Patch Update of June 2026 to WebCenter Content 14.1.2.0.0 by following the advisory at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle CPUs deliver the patches as Stack Patch Bundles or one-off patches against the affected Fusion Middleware home, so plan a WebLogic domain outage for the OPatch run. Until patched, restrict the Content Server HTTP endpoints to authenticated internal users via the fronting Oracle HTTP Server or load balancer, disable or tightly scope public check-in and contribution interfaces that allow externally supplied content to reach privileged reviewers, and warn administrators and content reviewers not to open or preview unsolicited documents or links inside the Content Server UI - these reduce the UI:R surface but will impair partner/customer self-service flows and any integration that posts content unauthenticated. No vendor-released exact patch identifier beyond the June 2026 CPU is enumerated in the supplied data, so confirm the precise patch number from the advisory before scheduling the change.