What is the CVSS score of CVE-2026-46791?

CVE-2026-46791 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-46791?

Within 24 hours: Identify all systems running Oracle WebCenter Content 14.1.2.0.0, classify stored data sensitivity levels, and contact Oracle Support for patch timeline and interim mitigation guidance. Within 7 days: Implement network-level access restrictions limiting content server exposure to trusted networks only, deploy web application firewall (WAF) rules to block exploit attempts, and enable enhanced audit logging with alerting on abnormal data access. Within 30 days: Establish formal vendor communication schedule for patch availability, evaluate upgrade feasibility to patched versions when released, and deploy intrusion detection signatures targeting CVE-2026-46791 exploitation attempts.

Oracle WebCenter Content CVE-2026-46791

EUVD-2026-37309 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify internet-exposed Content Server
Delivery

Send crafted unauthenticated HTTP request
Exploit

Bypass authorization on content endpoint
Execution

Retrieve protected documents
Impact

Exfiltrate sensitive ECM data

Vulnerability Assessment

Weakness	CWE CWE-284 MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Content 14.1.2.0.0 over HTTP, per CVSS AV:N/AC:L/PR:N/UI:N. The only practical limiting factors are network reachability of the Content Server endpoint (deployments behind a VPN, mTLS-terminating proxy, or IP allowlist are not directly exposed) and the specific version constraint: Oracle's advisory names 14.1.2.0.0 as the affected supported release, so deployments on other supported branches are not confirmed vulnerable from the provided data. Impact is bounded to data the Content Server itself can access - no integrity or availability impact per the CVSS vector.
Impact	All risk signals point in the same direction: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N is the worst-case exploitability profile - network-reachable, low complexity, no authentication, no user interaction - and confidentiality impact is High. EPSS data, KEV status, and SSVC framework decisions were not provided, so likelihood of mass exploitation cannot be quantified, but the 'easily exploitable' wording in Oracle's own advisory and the Authentication Bypass tag indicate this is a high-priority patch for any internet-exposed deployment. Integrity and availability impacts are None, so this is purely a data-exposure issue rather than a takeover/RCE risk - relevant when triaging against pure-RCE vulnerabilities in the same patch cycle. No public exploit identified at time of analysis, but the trivial attack profile means weaponization timelines for any leaked technical detail would be short.
Exploit ScenarioDerived	An attacker on the internet identifies a WebCenter Content 14.1.2.0.0 deployment exposed on HTTP, issues crafted unauthenticated requests against the Content Server component, and exfiltrates documents that should require login - for example contracts, HR records, or other regulated content stored in the ECM repository. Because attack complexity is Low and no privileges or user interaction are required, this can be scripted and run at scale once a working request is known, though no public exploit is identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 16, 2026

Unauthorized data disclosure in Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows unauthenticated remote attackers to access all data accessible to the application via HTTP. The flaw carries a CVSS 3.1 base score of 7.5 with high confidentiality impact and no integrity or availability impact, and currently has no public exploit identified at time of analysis.

RemediationAI

Apply the Oracle Critical Patch Update of June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html (patch available per vendor advisory; exact fix build number not enumerated in the provided data, so consult the CPU matrix for the correct patch ID against 14.1.2.0.0). Until the CPU can be deployed, restrict network access to the Content Server HTTP/HTTPS endpoints so they are reachable only from trusted internal networks or via an authenticating reverse proxy or WAF that enforces session validation before the request reaches the Content Server - note that this will break any legitimate unauthenticated integrations and may interfere with public-facing portal sites that rely on anonymous content retrieval. Increase logging and alerting on Content Server access logs for anomalous unauthenticated retrieval patterns while patching is in flight.

Affected VersionsENISA

Oracle WebCenter Content 14.1.2.0.0

Affected Packages

euvd oracle_webcenter_content no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle WebCenter Content is the enterprise content management platform within Oracle Fusion Middleware, used for document management, records management, and digital asset storage. The vulnerable Content Server component is the core ECM engine that handles ingestion, indexing, and retrieval of stored documents over HTTP/HTTPS. The CWE is not assigned in the provided data, but the tag 'Authentication Bypass' combined with PR:N and C:H impact strongly suggests a missing authorization check or broken access control on a content retrieval endpoint, allowing unauthenticated callers to reach data normally gated behind login. The CPE confirms scope is limited to Oracle Corporation's WebCenter Content product line.

Know when Oracle Webcenter Content gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI 7.5 HIGH

Network HTTP reach, no auth or interaction, easily exploitable per vendor; impact limited to disclosure of all Content Server data with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive ViewAI

Why It Matters

Oracle WebCenter Content 14.1.2.0.0 (Content Server) is vulnerable to unauthenticated remote data disclosure that could expose all application data to external attackers without requiring valid credentials. Organizations using this content management platform face significant confidentiality risk, particularly for any sensitive, proprietary, or regulated data stored within the system. No vendor patch is currently available, requiring immediate implementation of compensating controls.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Implement network segmentation restricting WebCenter Content access to authorized personnel only. Deploy WAF rules to detect and block HTTP requests targeting vulnerable endpoints. Require VPN or jump-host access for content administration. Enable comprehensive audit logging with real-time alerts for bulk data export or unusual access patterns. Consider logical air-gapping of systems containing highly sensitive data. Conduct immediate data inventory to identify and potentially isolate high-risk content stores.

Threat Intelligence Overview

EPSS Score

0.4%

Top 67% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.