What is the CVSS score of CVE-2026-46813?

CVE-2026-46813 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-46813?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to unauthenticated remote complete system compromise, with no vendor patch currently available.

How to fix or mitigate CVE-2026-46813?

**24 hours**: Conduct rapid inventory of all Oracle WebCenter Content deployments; immediately isolate or take offline any instances with internet or untrusted network access; declare incident response status. **7 days**: Implement network-layer access controls limiting HTTP/HTTPS traffic to trusted internal IP ranges only; deploy web application firewall rules to restrict anomalous request patterns; perform forensic review of access logs for evidence of exploitation. **30 days**: Upon Oracle patch release, test in non-production environment and deploy to all affected versions (12.2.1.4.0, 14.1.2.0.0) immediately; if Content Server is non-critical or redundant, evaluate migration to alternative solutions to permanently eliminate attack surface.

Oracle WebCenter Content CVE-2026-46813

EUVD-2026-37330 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes unauthenticated HTTP-reachable 'easy' exploitation leading to full Content Server takeover, justifying AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:51 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Unauthenticated remote takeover of Oracle WebCenter Content (Content Server component) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0 via a network-reachable HTTP attack path. The flaw carries a CVSS 9.8 with full confidentiality, integrity, and availability impact, and Oracle describes exploitation as 'easily exploitable.' No public exploit identified at time of analysis, but the combination of unauthenticated network reach and full compromise warrants prioritized patching of any internet-exposed Content Server.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management (ECM) platform within Oracle Fusion Middleware, providing document management, records, digital asset, and imaging services. The vulnerable component is the Content Server, the core Java EE service that handles HTTP-based content ingest, search, and administrative operations and is typically fronted by Oracle HTTP Server / WebLogic. CPE data (cpe:2.3:a:oracle_corporation:oracle_webcenter_content) confirms the affected product family. No CWE was assigned by Oracle in the advisory, so the underlying weakness class (deserialization, authentication bypass, SSRF, etc.) is not disclosed - Oracle's Critical Patch Update process routinely omits CWE detail, which is consistent here.

RemediationAI

Apply the fixes delivered in Oracle's June 2026 Critical Patch Update for Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 as referenced at https://www.oracle.com/security-alerts/cspujun2026.html; exact bundle patch numbers are listed in the CPU matrix and should be selected per the running Fusion Middleware version. Oracle has not published a workaround in the advisory, so compensating controls until patching is complete should focus on reducing network exposure: terminate Content Server access at an authenticated reverse proxy or WAF, restrict ingress to the Content Server HTTP/S ports (typically 16200/16201 and the OHS/WebLogic fronting ports) to trusted management networks or VPN, and disable any unauthenticated public ingest endpoints - accepting that these controls will break federated content submission, anonymous portal browse, and some WebCenter Portal integrations. Monitor Content Server access logs for anomalous unauthenticated requests to /cs, /idcplg, and /_dav while the patch is rolling out.