What is the CVSS score of CVE-2026-46804?

CVE-2026-46804 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-46804?

Oracle WebCenter Content 14.1.2.0.0 contains a critical cross-tenant data compromise vulnerability (CVE-2026-46804, CVSS 8.7) that allows authenticated users with low privileges to gain unauthorized…

How to fix or mitigate CVE-2026-46804?

24 hours: Identify all systems running Oracle WebCenter Content 14.1.2.0.0, classify data sensitivity, and establish baseline of authorized user access patterns. 7 days: Restrict WebCenter Content access to essential personnel only, revoke non-critical user privileges, and implement enhanced monitoring for suspicious content access, creation, modification, and deletion operations. 30 days: Apply vendor patch immediately upon release; maintain interim controls until patch deployment is verified on all affected systems.

Oracle WebCenter Content CVE-2026-46804

EUVD-2026-37322 HIGH

Improper Privilege Management (CWE-269)

2026-06-16 oracle

Authentication Bypass Privilege Escalation Oracle Oracle Webcenter Content Oracle Corporation

8.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Network HTTP reach with a low-privileged account (PR:L), required victim interaction (UI:R), and a scope-changing cross-product impact on confidentiality and integrity but no availability effect per Oracle's description.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:55 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

AnalysisAI

Cross-tenant data compromise in Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows a low-privileged authenticated attacker to coerce another user into an interaction that yields unauthorized read, create, modify, or delete access to all WebCenter Content data, with a scope change extending impact to additional Oracle Fusion Middleware products. Disclosed in Oracle's June 2026 Critical Patch Update with a CVSS 3.1 base score of 8.7; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Content (formerly Oracle UCM/Stellent) is the enterprise content management platform within Oracle Fusion Middleware, providing document management, records management, and digital asset services over HTTP via the Content Server. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_content scopes the flaw to the Content Server component running on the 14.1.2.0.0 release. The vendor tag 'Authentication Bypass' combined with the CVSS scope change (S:C) and required user interaction (UI:R) is consistent with a flaw where an authenticated low-privileged session, once a victim interacts with attacker-supplied content or a URL, can pivot across trust boundaries to act on data belonging to other principals or downstream Fusion Middleware components. No CWE was assigned in the input, but the pattern aligns with cross-site or content-driven authorization confusion in the Content Server's HTTP handlers.

RemediationAI

Apply the patch from Oracle's June 2026 Critical Patch Update for Oracle WebCenter Content 14.1.2.0.0 as documented at https://www.oracle.com/security-alerts/cspujun2026.html (Patch available per vendor advisory; no independently confirmed standalone fix version beyond the CPU bundle in the supplied data). Until the CPU is applied, restrict Content Server HTTP access to trusted networks via a reverse proxy or WAF rule set, disable self-service account creation and tighten the lowest-privilege roles so the PR:L precondition is harder to satisfy, and brief privileged Content Server users to avoid clicking links or opening previews originating from low-privileged or untrusted accounts since exploitation requires their interaction; note that locking down self-service signup and narrowing UI-rendered content may break legitimate collaboration workflows and should be coordinated with content owners.