Oracle WebCenter Content CVE-2026-46806

Target must be Oracle WebCenter Content 14.1.2.0.0 with the Content Server component reachable over HTTPS from the attacker (per AV:N), and a legitimate user - explicitly stated by Oracle as 'a person other than the attacker' - must perform an interaction such as clicking a crafted link or loading a crafted page (UI:R). No attacker credentials are required (PR:N), and exploitation is rated low complexity (AC:L) against the default 14.1.2.0.0 configuration. Limiting factors: the required victim interaction means there is no autonomous/wormable exploitation, and the meaningful blast radius depends on the victim having privileged access in the federated products reached via the scope change.

Signals diverge and need to be weighed carefully. CVSS 3.1 is 8.2 (High) driven by AV:N/AC:L/PR:N plus scope change and C:H, which would normally argue for prioritisation; however UI:R means an authenticated WebCenter user (or admin) must be lured into triggering the flaw, and A:N + I:L mean no service disruption and only partial integrity impact. There is no EPSS score, no KEV listing, no public POC, and Oracle's CPU advisories are typically released with limited technical detail, so mass exploitation is unlikely in the short term. The tag 'Authentication Bypass' in the third-party feed conflicts with Oracle's own text (which describes scope-changing data exposure, not auth bypass) and should not be trusted without corroboration. Net: a real priority for any internet-exposed or partner-facing WebCenter 14.1.2.0.0 deployment, but lower urgency than a no-UI RCE; patch in the next Oracle CPU cycle rather than emergency-out-of-band unless your WebCenter is internet-facing.

An attacker emails or messages a malicious HTTPS link pointing at the target organisation's WebCenter Content Server; when an authenticated WebCenter user opens it, the Content Server endpoint reflects or processes attacker-controlled content in the user's authenticated context, which the scope change lets the attacker pivot into a federated Fusion Middleware component (for example exfiltrating session material or documents the user can reach). No public exploit was identified at time of analysis.