Oracle WebCenter Content CVE-2026-46805

Requires a reachable Oracle WebCenter Content 14.1.2.0.0 Content Server over HTTP and a victim user - distinct from the attacker - who interacts with attacker-controlled content (UI:R), typically by clicking a crafted link or visiting a malicious page while a session to the Content Server is established or establishable. Exploitation does not require the attacker to hold any credentials (PR:N) and the attack complexity is low (AC:L), but it is bounded by: the deployment must run the specific 14.1.2.0.0 release, the HTTP endpoint must be reachable from the victim's browser, and a user must actually take the interaction step - fully unattended servers with no human users cannot be exploited via this path.

All hard signals point to a high-priority issue: CVSS 9.3 with AV:N/AC:L/PR:N reflects easy, unauthenticated, network-reachable exploitation, and the S:C scope change is what pushes the score above 9. The mitigating factors are UI:R (a human other than the attacker must interact, e.g. click a link or open a crafted page) and A:N (no availability impact - the attacker cannot take the server down through this flaw). EPSS data was not supplied with the input, so probabilistic exploitation likelihood cannot be quantified here, and the CVE is not on CISA KEV, so this is best treated as a high-severity, not-yet-exploited issue rather than an emergency zero-day. The 'Authentication Bypass' tag is in tension with the UI:R requirement - auth bypass usually implies no user interaction - which suggests the tag is a coarse vendor label rather than a precise classification; the actual exploit likely chains a content-side trick with a victim's existing session, so prioritise patching authenticated WebCenter Content portals with broad user populations.

An attacker hosts a crafted page or sends a link (email, Teams, Slack) to a WebCenter Content user with an active session; when the victim clicks, the page issues HTTP requests that exploit the Content Server's flaw to create, modify, or exfiltrate documents under the victim's authority, with the scope change letting the same request also affect a connected Fusion Middleware product. No public exploit is identified at the time of analysis, but the AC:L/PR:N profile means a working PoC, once published, would be straightforward to weaponise against any exposed 14.1.2.0.0 portal.