Oracle WebCenter Content CVE-2026-46804

Attacker must hold a low-privileged authenticated account on the targeted Oracle WebCenter Content 14.1.2.0.0 Content Server reachable over HTTP, and a different user - not the attacker - must perform an interaction with attacker-supplied content or URL through the Content Server interface (CVSS UI:R). Exploitation is limited to the 14.1.2.0.0 release identified by Oracle and ENISA EUVD-2026-37322, requires network reachability to the Content Server HTTP endpoint (so Content Server instances behind VPN or IP allowlists are partially shielded), and depends on the victim having privileges or data scope that the attacker lacks - without that privilege differential the scope-change impact does not materialize.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N realistically describes a high-impact confidentiality and integrity issue that is gated by two real-world frictions: the attacker must already hold a low-privileged Content Server account, and a second user (likely a higher-privileged one) must perform an interaction such as clicking a link or rendering attacker-controlled content. The scope change makes this materially worse than an in-tenant data exposure because impact extends to other Oracle Fusion Middleware data reachable through Content Server. No EPSS score, KEV listing, or SSVC decision was provided in the input, and no public exploit identified at time of analysis, so this should be treated as a credible high-severity patch-cycle priority rather than an emergency, with elevated urgency for internet-exposed Content Server deployments and any tenant that grants self-service account creation. The vendor tag 'Authentication Bypass' is in mild tension with the CVSS PR:L choice - verify with Oracle's advisory whether the bypass affects horizontal authorization (the more likely reading) or vertical authentication.

An attacker registers or compromises a low-privileged Content Server account, uploads or shares a crafted item, and lures an administrator or higher-privileged colleague into opening it through the Content Server UI; the resulting interaction causes the Content Server to act with the victim's authority across the trust boundary, letting the attacker read, modify, or delete arbitrary content and reach data in linked Fusion Middleware components. No public exploit identified at time of analysis, and the AC:L/UI:R profile means a single successful social-engineering touch is usually enough to complete the chain.