Oracle WebCenter Content CVE-2026-46808

Attacker must (1) reach the Oracle WebCenter Content 14.1.2.0.0 Content Server over HTTP/HTTPS, (2) hold valid low-privileged credentials on that instance (CVSS PR:L), and (3) induce a separate user - not themselves - to perform an action such as opening, previewing, or processing attacker-supplied content (CVSS UI:R). Exploitation is limited to instances running exactly 14.1.2.0.0, and impact is confined to confidentiality and integrity (A:N) - availability is not affected; the scope-change flag means damage can extend to other Fusion Middleware products only where they trust or consume WebCenter Content data or sessions.

Signals are mixed: CVSS 3.1 is 8.7 (High) driven by network vector, low attack complexity, scope change, and high C/I impact, which Oracle classifies as 'easily exploitable'. However, PR:L means an attacker must already hold a low-privileged WebCenter account, and UI:R means a second human (not the attacker) must perform an action - both materially reduce drive-by mass-exploit potential. There is no EPSS score provided, no SSVC decision data, no CISA KEV listing, and no public POC referenced; only Oracle's quarterly advisory documents the issue. The 'Authentication Bypass' tag conflicts with the CVSS PR:L value (which explicitly requires privileges) - this discrepancy should be verified against Oracle's CPU notes before treating the bug as pre-auth. Realistic priority is high for internet-exposed WebCenter Content 14.1.2.0.0 deployments with many low-tier users, lower for isolated internal instances; treat as a standard Oracle CPU patch obligation rather than an emergency until POC or KEV signals change.

An attacker who has obtained or registered a low-privileged WebCenter Content account uploads or edits a content item containing a malicious payload, then waits for a higher-privileged user (e.g., a reviewer or administrator) to open or process it over HTTP. When the victim interacts with the content, the payload executes in the victim's session context and the scope-change condition lets the attacker read or alter critical data across WebCenter Content and connected Fusion Middleware products. No public exploit identified at time of analysis.