What is the CVSS score of CVE-2026-46805?

CVE-2026-46805 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-46805?

Oracle WebCenter Content 14.1.2.0.0 contains a critical vulnerability (CVSS 9.3) that allows unauthenticated attackers to read, modify, or delete all data accessible through WebCenter Content when…

How to fix or mitigate CVE-2026-46805?

Within 24 hours: inventory all Oracle WebCenter Content 14.1.2.0.0 deployments and document connected Fusion Middleware products; enforce HTTPS-only protocols and disable HTTP access. Within 7 days: implement network segmentation limiting WebCenter Content 14.1.2.0.0 access to authorized staff only; deploy web application firewall rules blocking user interactions with untrusted external content. Within 30 days: request patch status and availability timeline from Oracle; prepare remediation plan for version 14.1.2.0.0 including testing and staged deployment.

Oracle WebCenter Content CVE-2026-46805

EUVD-2026-37323 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

9.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

9.3 CRITICAL

HTTP-reachable, unauthenticated, but requires victim interaction; scope change into adjacent Fusion Middleware product, high confidentiality and integrity impact, no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:54 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).

AnalysisAI

Cross-scope compromise in Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows an unauthenticated remote attacker to read, modify, or delete all WebCenter Content-accessible data when a victim is lured into interacting with attacker-supplied content over HTTP. The scope-changed (S:C) nature of the flaw means impact extends beyond WebCenter Content into adjacent products in the Fusion Middleware deployment, earning a CVSS 9.3 rating. There is no public exploit identified at time of analysis, and the issue is not on CISA KEV.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management platform within Oracle Fusion Middleware, used for document storage, records management, imaging, and digital asset management; the Content Server is its core repository and HTTP-facing service. The CPE narrows the issue to oracle_webcenter_content, and the EUVD entry (EUVD-2026-37323) lists the exact build 14.1.2.0.0 as vulnerable. No CWE is supplied by NVD, but the vendor-applied 'Authentication Bypass' tag combined with PR:N, UI:R, and S:C is consistent with a client-side vector - likely a reflected or stored HTTP response handling weakness (e.g., a request-smuggling, XSS-to-API, or HTTP-header injection class issue) that lets attacker-controlled requests, once a user clicks or visits a crafted resource, perform privileged content operations against the Content Server and a neighbouring component.

RemediationAI

Patch available per vendor advisory - apply the fixes in Oracle's Critical Patch Update Advisory of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html), which is the only release channel Oracle ships security fixes through for WebCenter Content; a specific patched build number is not surfaced in the supplied input, so consult the CPU matrix for the exact 14.1.2.0.0 patch ID applicable to your environment. Until the CPU is deployed, reduce exposure by restricting HTTP access to the Content Server to authenticated internal networks via reverse-proxy ACLs or VPN-only access (trade-off: breaks external content-sharing workflows and any partner integrations), and enforce a strict Content-Security-Policy plus SameSite=strict on session cookies at the load balancer to blunt the UI:R/scope-change client-side leg (trade-off: may break embedded WebCenter widgets and cross-origin Fusion Middleware integrations). Brief users on phishing tied to internal document links, since exploitation requires a victim to click an attacker-supplied URL while authenticated.