What is the CVSS score of CVE-2026-46789?

CVE-2026-46789 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-46789?

Oracle WebCenter Content 14.1.2.0.0 deployments face critical risk from an unauthenticated remote vulnerability (CVE-2026-46789, CVSS 9.6) with no patch available-any attacker on the network can…

How to fix or mitigate CVE-2026-46789?

24 hours: Inventory all systems running Oracle WebCenter Content 14.1.2.0.0 and assess data criticality; immediately restrict network access to Content Server to trusted internal networks only. 7 days: Contact Oracle Support to confirm patch timeline and ETA; evaluate network segmentation and Web Application Firewall deployment for HTTP traffic filtering. 30 days: Implement persistent network isolation, enable detailed Content Server logging and monitoring, and establish upgrade plan for patched version upon vendor release.

Oracle WebCenter Content CVE-2026-46789

EUVD-2026-37307 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

9.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Network HTTP reach with no attacker auth (AV:N/PR:N), low complexity, but victim interaction required (UI:R); scope changes to other products with full CIA loss per Oracle's takeover description.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:02 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebCenter Content 14.1.2.0.0 (Content Server component) is achievable by unauthenticated network attackers who can lure a victim into triggering a crafted HTTP interaction, with scope change extending impact to additional products. Oracle's June 2026 Critical Patch Update advisory (cspujun2026) assigns CVSS 9.6 reflecting full confidentiality, integrity, and availability loss, and no public exploit identified at time of analysis.

Technical ContextAI

Oracle WebCenter Content (formerly Universal Content Management / Stellent UCM) is the enterprise content management platform within Oracle Fusion Middleware, exposing the Content Server via HTTP for document ingestion, metadata management, and integration with Fusion apps. The vulnerable component is the Content Server itself (cpe:2.3:a:oracle_corporation:oracle_webcenter_content:14.1.2.0.0), which historically has been affected by deserialization, SSRF, and authentication-bypass weaknesses; Oracle did not publish a CWE for this entry, but the UI:R + S:C profile is consistent with a client-side or cross-context flaw (e.g., reflected/stored XSS, CSRF leading to privileged action, or open-redirect-into-RCE chain) where the victim's authenticated browser context propagates impact across products such as WebCenter Portal, IDCS, or downstream Fusion Middleware components.

RemediationAI

Apply the patch available per vendor advisory in the Oracle Critical Patch Update June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) to Oracle WebCenter Content 14.1.2.0.0; Oracle's CPU bundles do not always expose a discrete fix-version string in the entry, so administrators should map their installation to the CPU's WebCenter Content patch ID and stage it in a non-production environment first because Fusion Middleware CPUs frequently require coordinated OPatch runs and WebLogic restarts. Until patching, restrict Content Server's HTTP/HTTPS endpoints to trusted networks via WAF or reverse-proxy ACLs, enforce a strict Content-Security-Policy and X-Frame-Options on the Content Server response chain to blunt UI-driven attacks (trade-off: may break legitimate iframe-based portal integrations), require re-authentication for sensitive content actions, and brief administrators against opening untrusted document links or previews - recognizing that UI:R-based exploitation typically targets privileged users via spear-phishing.