EUVD-2026-37307Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network HTTP reach with no attacker auth (AV:N/PR:N), low complexity, but victim interaction required (UI:R); scope changes to other products with full CIA loss per Oracle's takeover description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
AnalysisAI
Remote takeover of Oracle WebCenter Content 14.1.2.0.0 (Content Server component) is achievable by unauthenticated network attackers who can lure a victim into triggering a crafted HTTP interaction, with scope change extending impact to additional products. Oracle's June 2026 Critical Patch Update advisory (cspujun2026) assigns CVSS 9.6 reflecting full confidentiality, integrity, and availability loss, and no public exploit identified at time of analysis.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) network HTTP/HTTPS reachability to an Oracle WebCenter Content 14.1.2.0.0 Content Server instance, and (2) human interaction from a victim other than the attacker - per the description and UI:R in the CVSS vector - meaning a legitimate user (typically an authenticated WebCenter operator or admin) must click a link, open a crafted document, or render attacker-supplied content in their browser session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to a high-priority issue: CVSS 9.6 with AV:N/AC:L/PR:N reflects an internet-reachable, low-complexity, unauthenticated attack, while S:C with C:H/I:H/A:H confirms total compromise that spills into adjacent products - significant for tightly integrated Fusion Middleware deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker emails a WebCenter Content administrator a link or document preview URL that, when opened in the admin's authenticated browser, triggers a crafted HTTP interaction against Content Server; the scope-changing flaw then leverages the admin's session to perform privileged actions across the integrated Fusion Middleware stack, resulting in takeover of WebCenter Content and lateral impact on connected products. No public exploit identified at time of analysis, so this scenario is inferred from the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) rather than observed tradecraft. |
| Remediation | Apply the patch available per vendor advisory in the Oracle Critical Patch Update June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) to Oracle WebCenter Content 14.1.2.0.0; Oracle's CPU bundles do not always expose a discrete fix-version string in the entry, so administrators should map their installation to the CPU's WebCenter Content patch ID and stage it in a non-production environment first because Fusion Middleware CPUs frequently require coordinated OPatch runs and WebLogic restarts. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Inventory all systems running Oracle WebCenter Content 14.1.2.0.0 and assess data criticality; immediately restrict network access to Content Server to trusted internal networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) allows a low-privilege
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged remote attacker over HT
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker sending HTTP req
Remote takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to fully
Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via the Content Server
Share
External POC / Exploit Code
Leaving vuln.today