EUVD-2026-46880
GHSA-m4vj-89cf-xvv8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege HTTP account
-
DeliverySend crafted request to Imaging Core
-
ExploitAbuse flaw to escalate
-
ExecutionTake over Imaging service
-
ImpactRead/alter documents, disrupt availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to the WebCenter Content: Imaging Core component and a valid low-privileged account (CVSS PR:L, so this is authenticated - not anonymous). No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning any authenticated low-trust user on a reachable Imaging instance running the affected 12.2.1.4.0 or 14.1.2.0.0 builds can attempt it against default configurations. The limiting factors are the credential requirement (at least a minimal Imaging login) and network reachability of the HTTP interface; instances exposed only to trusted internal users or segmented behind restrictive proxies present a materially smaller attack surface. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) signals a genuinely serious issue: network-reachable, low attack complexity, no user interaction, and full C/I/A impact - meaning any low-privileged account can take over the service. The one meaningful barrier is PR:L: an attacker needs valid (if minimal) credentials, which limits fully anonymous internet exploitation and raises the bar versus a PR:N flaw. Countervailing signals lower the immediate urgency: no EPSS score was provided, there is no POC, and the CVE is not on CISA KEV, so there is no evidence of active or automated exploitation yet. Note a tension in the data - Oracle tags this 'Information Disclosure' yet scores full integrity and availability impact and describes complete 'takeover,' so the tag understates the true blast radius; treat the CVSS/'takeover' language as authoritative. Overall this is a real patch-now priority for anyone running WebCenter Imaging with low-trust user access, but the credential requirement makes mass, unauthenticated exploitation less likely than a PR:N bug. |
| Exploit ScenarioDerived | An attacker who holds or phishes a low-privilege WebCenter Imaging account sends crafted HTTP requests to the Core component over the network, requiring no user interaction and only low attack complexity. By abusing the flaw they escalate from limited access to full control of the Imaging service, reading, altering, or destroying stored documents and disrupting availability. No public POC is known, so a working exploit would currently require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Account takeover in Oracle WebCenter Content: Imaging (Core component of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, authenticated attacker with network HTTP access fully compromise the Imaging service. Rated CVSS 8.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as 'easily exploitable' and results in complete takeover of the product. No public exploit identified at time of analysis, and it is not on CISA KEV.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 stacks; Oracle ships these as CPU patches rather than a single renamed release, so the exact patched build must be taken from the CPU patch matrix for your version - no standalone fixed version number was provided in this data, so do not assume one. Until the CPU is applied, reduce exposure by restricting network access to the Imaging HTTP endpoints to trusted management networks or via a reverse proxy/WAF allowlist (trade-off: may block legitimate remote or integration users), and tighten account provisioning so that low-privilege Imaging accounts are minimized and closely monitored, since PR:L means the attack requires a valid login (trade-off: does not remove the flaw, only shrinks the attacker pool). Because Oracle does not publish workarounds outside the CPU, patching is the only vendor-supported remediation; the controls above are compensating measures only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WebCenter Content: Imaging is the document-imaging and capture module of Oracle Fusion Middleware's WebCenter Content platform, used to ingest, index, store, and route scanned documents and invoices, typically fronted by a Java/WebLogic HTTP application tier. The vulnerable 'Core' component is reachable over HTTP by any authenticated user, and successful exploitation yields full control of the Imaging application. Oracle did not assign a CWE (CWE: N/A) and, per its standard Critical Patch Update practice, withheld root-cause detail, so the specific weakness class (e.g. deserialization, injection, or access-control flaw) cannot be confirmed from the available data despite the vendor-supplied 'Information Disclosure' tag.
Know when Webcenter Content gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reachability with low complexity and no interaction, but a valid low-privilege login is required (PR:L), yielding full takeover so C/I/A all High.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebCenter Content: Imaging. Successful attacks of this vulnerability can result in takeover of WebCenter Content: Imaging. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Content: Imaging (versions 12.2.1.4.0 and 14.1.2.0.0) in Oracle Fusion Middleware contains a vulnerability allowing authenticated users to fully compromise the service and perform account takeover. While no public exploit identified at time of analysis, the high severity rating and ease of exploitation require immediate action to protect sensitive content and critical document management operations. Organizations must immediately inventory affected systems and restrict access to users with verified business need.
Implement strict role-based access controls limiting Imaging service access to users with verified business need only; require multi-factor authentication for all Imaging service accounts; establish real-time monitoring and alerting for account takeover indicators (unusual login patterns, bulk content access, permission changes); maintain comprehensive audit logs for forensic investigation of potential compromise; consider temporary access restrictions or department-based IP whitelisting based on risk tolerance pending patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Webcenter Content
View allVulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rate
Full takeover of Oracle WebCenter Content (Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthentica
Privilege escalation to full takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component)
Remote unauthenticated takeover of Oracle WebCenter Content: Imaging (versions 12.2.1.4.0 and 14.1.2.0.0) is possible vi
Remote takeover of Oracle WebCenter Content: Imaging (Fusion Middleware Core component) allows an unauthenticated attack
Full remote takeover of Oracle WebCenter Content (Fusion Middleware Content Server) is possible when an unauthenticated
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 a
Scope-changing information disclosure and data tampering in Oracle WebCenter Content (Content Server component) versions
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware releases 12.2.1.4.0 a
Unauthenticated remote compromise of Oracle WebCenter Content: Imaging (component: Core) in Oracle Fusion Middleware ver
Unauthenticated data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware Web Content Man
Account takeover in Oracle WebCenter Content: Imaging (Fusion Middleware) allows a low-privileged authenticated attacker
Exploit-DB