EUVD-2026-61290
GHSA-ggxj-6c96-ch2r
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
PR:L confirmed by description requiring a low-privileged account; UI:R reflects mandatory victim interaction; S:C reflects explicitly stated cross-product impact; A:N as no availability impact is described.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 14.1.2.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
AnalysisAI
Oracle WebCenter Content's Content Server component, in versions 14.1.2.0.0 and 12.2.1.4.0, exposes an authentication bypass that allows a low-privileged remote attacker to achieve full confidentiality and integrity compromise of all accessible content data - and, due to a confirmed scope change, may significantly impact additional Oracle Fusion Middleware products integrated with the platform. Exploitation is network-accessible over HTTP with low complexity but requires a valid low-privileged account and human interaction from a separate victim, classifying this as a socially-engineered or CSRF-class attack surface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the attacker holds a valid low-privileged account on the target Oracle WebCenter Content instance - fully unauthenticated exploitation is not possible (PR:L); (2) a separate victim user - typically with higher privileges - must perform an interaction such as clicking a crafted link or loading an attacker-controlled resource during an active session (UI:R); (3) the target runs Content Server under Oracle WebCenter Content versions 14.1.2.0.0 or 12.2.1.4.0 specifically. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.7 reflects a genuinely serious vulnerability: the scope change (S:C) amplifies the score by propagating confidentiality and integrity impact beyond the directly targeted product. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's Critical Security Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses this vulnerability across both affected versions (14.1.2.0.0 and 12.2.1.4.0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Oracle WebCenter Content versions 14.1.2.0.0 and 12.2.1.4.0 and immediately restrict network access to the Content Server via firewall rules to limit exposure to trusted administrative networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Webcenter Content
View allVulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rate
Full takeover of Oracle WebCenter Content (Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthentica
Privilege escalation to full takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component)
Remote unauthenticated takeover of Oracle WebCenter Content: Imaging (versions 12.2.1.4.0 and 14.1.2.0.0) is possible vi
Remote takeover of Oracle WebCenter Content: Imaging (Fusion Middleware Core component) allows an unauthenticated attack
Full remote takeover of Oracle WebCenter Content (Fusion Middleware Content Server) is possible when an unauthenticated
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 a
Scope-changing information disclosure and data tampering in Oracle WebCenter Content (Content Server component) versions
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware releases 12.2.1.4.0 a
Unauthenticated remote compromise of Oracle WebCenter Content: Imaging (component: Core) in Oracle Fusion Middleware ver
Unauthenticated data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware Web Content Man
Account takeover in Oracle WebCenter Content: Imaging (Fusion Middleware) allows a low-privileged authenticated attacker
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today