What is the CVSS score of CVE-2026-46791?

CVE-2026-46791 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-46791?

Oracle WebCenter Content 14.1.2.0.0 (Content Server) is vulnerable to unauthenticated remote data disclosure that could expose all application data to external attackers without requiring valid…

How to fix or mitigate CVE-2026-46791?

Within 24 hours: Identify all systems running Oracle WebCenter Content 14.1.2.0.0, classify stored data sensitivity levels, and contact Oracle Support for patch timeline and interim mitigation guidance. Within 7 days: Implement network-level access restrictions limiting content server exposure to trusted networks only, deploy web application firewall (WAF) rules to block exploit attempts, and enable enhanced audit logging with alerting on abnormal data access. Within 30 days: Establish formal vendor communication schedule for patch availability, evaluate upgrade feasibility to patched versions when released, and deploy intrusion detection signatures targeting CVE-2026-46791 exploitation attempts.

Oracle WebCenter Content CVE-2026-46791

EUVD-2026-37309 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network HTTP reach, no auth or interaction, easily exploitable per vendor; impact limited to disclosure of all Content Server data with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:02 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows unauthenticated remote attackers to access all data accessible to the application via HTTP. The flaw carries a CVSS 3.1 base score of 7.5 with high confidentiality impact and no integrity or availability impact, and currently has no public exploit identified at time of analysis.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management platform within Oracle Fusion Middleware, used for document management, records management, and digital asset storage. The vulnerable Content Server component is the core ECM engine that handles ingestion, indexing, and retrieval of stored documents over HTTP/HTTPS. The CWE is not assigned in the provided data, but the tag 'Authentication Bypass' combined with PR:N and C:H impact strongly suggests a missing authorization check or broken access control on a content retrieval endpoint, allowing unauthenticated callers to reach data normally gated behind login. The CPE confirms scope is limited to Oracle Corporation's WebCenter Content product line.

RemediationAI

Apply the Oracle Critical Patch Update of June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html (patch available per vendor advisory; exact fix build number not enumerated in the provided data, so consult the CPU matrix for the correct patch ID against 14.1.2.0.0). Until the CPU can be deployed, restrict network access to the Content Server HTTP/HTTPS endpoints so they are reachable only from trusted internal networks or via an authenticating reverse proxy or WAF that enforces session validation before the request reaches the Content Server - note that this will break any legitimate unauthenticated integrations and may interfere with public-facing portal sites that rely on anonymous content retrieval. Increase logging and alerting on Content Server access logs for anomalous unauthenticated retrieval patterns while patching is in flight.