EUVD-2026-46861
GHSA-75r7-55mj-8wj3
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Network HTTP reach with no auth (AV:N/PR:N) but reliant on tricked third-party user (UI:R) and hard-to-meet conditions (AC:H), yielding full application takeover (C:H/I:H/A:H, scope unchanged).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebCenter Content: Imaging. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of WebCenter Content: Imaging. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
AnalysisAI
Account/application takeover in Oracle WebCenter Content: Imaging (Core component of Fusion Middleware) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, where a remote unauthenticated attacker who lures a legitimate user into interacting with malicious content over HTTP can fully compromise the Imaging application. Oracle rates it CVSS 3.1 7.5 with high confidentiality, integrity, and availability impact, but flags it as difficult to exploit (AC:H) and dependent on user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix ships in the Oracle July 2026 Critical Patch Update.
Technical ContextAI
WebCenter Content: Imaging is the image/document capture and workflow module of Oracle's WebCenter Content enterprise content management (ECM) suite, part of Oracle Fusion Middleware and typically fronted by WebLogic Server over HTTP/HTTPS. The advisory lists no CWE, so the precise root-cause class is not assigned in the source data; the combination of network vector, required human interaction from a third party, and full C/I/A takeover is consistent with a client-mediated flaw (for example a cross-site or content-injection style issue that abuses an authenticated victim's session), though this is inferred from the CVSS shape rather than confirmed by a CWE. Oracle scopes the impact strictly to the Imaging application itself (Scope: Unchanged), meaning compromise is bounded to WebCenter Content: Imaging and not automatically to the host OS or adjacent Fusion Middleware components.
RemediationAI
Apply the Oracle July 2026 Critical Patch Update, which per the vendor advisory (https://www.oracle.com/security-alerts/cpujul2026.html) contains the fix for both affected releases (12.2.1.4.0 and 14.1.2.0.0); Oracle CPUs are cumulative, so install the full quarterly patch rather than a standalone hotfix, and no independently confirmed exact patched build number is available in the input beyond the CPU itself. Until patched, because exploitation depends on a victim being induced to interact with attacker content over HTTP, reduce exposure by restricting network reachability of the Imaging endpoints to trusted internal users via network ACLs or a reverse proxy/WAF (trade-off: may break legitimate external imaging workflows), enforce strict output encoding/content controls at the proxy if a specific vulnerable URL path is identified, and brief users handling imaging content to avoid untrusted links/documents (trade-off: awareness-based control, not a technical guarantee). Patch status: Patch available per vendor advisory (Oracle CPU July 2026).
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today