EUVD-2026-47008
GHSA-5c4x-mhqw-ch22
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WebCenter Content HTTP endpoint
-
DeliverySend request bypassing authentication
-
ExploitInvoke privileged content operation
-
ExecutionRead or alter managed content data
-
ImpactExfiltrate or tamper critical data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Oracle WebCenter Content HTTP interface of an instance running the affected 12.2.1.4.0 or 14.1.2.0.0 versions of the Web Content Management component - no authentication, no special configuration toggle, and no user interaction are needed (PR:N/UI:N), consistent with the vendor's 'easily exploitable' and 'Authentication Bypass' characterization. The primary limiting factors are therefore version (only the two named supported releases are stated as affected) and exposure (the content HTTP endpoint must be reachable by the attacker); instances that are network-segmented, behind a VPN, or fronted by strict access controls are correspondingly harder to reach even though the flaw itself needs no special preconditions. |
| Impact | All CVSS signals point to genuinely high real-world risk: the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N is fully remote, low-complexity, pre-authentication, and needs no user interaction, and Oracle's own description calls it 'easily exploitable,' which aligns with an SSVC 'automatable' profile. Technical impact is total for the data plane (C:H/I:H) though scope is unchanged (S:U) and there is no availability impact (A:N), so the ceiling is data theft and tampering rather than host takeover. Countervailing signals: EPSS is not provided, there is no POC and no CISA KEV listing, so exploitation is currently theoretical rather than observed - the score reflects potential, not confirmed activity. Given Oracle Fusion Middleware's history of internet-exposed WebCenter/WebLogic targets being weaponized after CPU disclosure, treat this as a priority-patch item despite the absence of an EPSS number or public exploit at this time. |
| Exploit ScenarioDerived | An attacker who can reach the WebCenter Content HTTP interface sends crafted requests that bypass authentication and directly invoke content operations, then reads sensitive managed documents and creates, modifies, or deletes content without ever logging in. Because no user interaction, credentials, or elevated privileges are required (AV:N/AC:L/PR:N/UI:N), this can be scripted against any exposed instance; no public POC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthenticated data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware Web Content Management component) lets a remote attacker read, create, delete, or modify all data accessible to the product over HTTP with no credentials or user interaction. Oracle rates it CVSS 9.1 (C:H/I:H) and vendor tags describe it as an authentication bypass, making it a high-priority patch from the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected 12.2.1.4.0 and 14.1.2.0.0 branches - this is Patch available per vendor advisory, as Oracle CPUs ship cumulative patches but the input does not include a distinct fixed build number, so confirm the exact patch/bundle ID from the CPU advisory for your version. Until patching is complete, reduce exposure by restricting network access to WebCenter Content HTTP endpoints so they are not reachable from the internet or untrusted networks (place behind a VPN or IP allowlist), and put a WAF or reverse proxy in front of the content-management endpoints to filter anomalous requests; the trade-off is that overly aggressive filtering or access restriction can disrupt legitimate content authors and integrated applications that call these services. Because the flaw is an unauthenticated authentication bypass, host-level authentication tightening alone will not close it - the vendor patch is the only reliable fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Content is an enterprise content management (ECM) platform within Oracle Fusion Middleware, typically deployed on WebLogic Server and exposed via HTTP-based content services and web interfaces. The affected component is Web Content Management, which handles authoring, storage, and delivery of managed content. The vendor tag 'Authentication Bypass' indicates the root cause class is a broken or missing authentication/authorization check (conceptually CWE-287/CWE-306) that allows requests to reach privileged content operations without valid credentials; NVD lists CWE as N/A, so the exact weakness is not formally classified. Because the flaw yields both confidentiality and integrity impact but no availability impact, the underlying issue is access-control over data operations rather than a memory-safety or denial-of-service defect.
Know when Webcenter Content gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Remote unauthenticated HTTP authentication bypass with no user interaction (AV:N/AC:L/PR:N/UI:N); full read/write of accessible data (C:H/I:H) but no availability impact (A:N), scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical unauthenticated authentication bypass (CVSS 9.1) enabling remote attackers to read, create, delete, and modify all data without credentials. No vendor patch is currently available. Any organization operating this product faces immediate risk of complete data compromise across all content repositories.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to WebCenter Content to internal-only (disable internet routing), implement reverse proxy requiring additional authentication, enable comprehensive HTTP access logging to detect exploitation attempts, and monitor for suspicious data access patterns. These controls reduce exposure window but do not eliminate the underlying vulnerability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Webcenter Content
View allVulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rate
Full takeover of Oracle WebCenter Content (Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthentica
Privilege escalation to full takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component)
Remote unauthenticated takeover of Oracle WebCenter Content: Imaging (versions 12.2.1.4.0 and 14.1.2.0.0) is possible vi
Remote takeover of Oracle WebCenter Content: Imaging (Fusion Middleware Core component) allows an unauthenticated attack
Full remote takeover of Oracle WebCenter Content (Fusion Middleware Content Server) is possible when an unauthenticated
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 a
Scope-changing information disclosure and data tampering in Oracle WebCenter Content (Content Server component) versions
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware releases 12.2.1.4.0 a
Unauthenticated remote compromise of Oracle WebCenter Content: Imaging (component: Core) in Oracle Fusion Middleware ver
Account takeover in Oracle WebCenter Content: Imaging (Fusion Middleware) allows a low-privileged authenticated attacker
Full compromise of Oracle WebCenter Content is possible in versions 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management co
Exploit-DB