Oracle WebCenter Content CVE-2026-70858

Exploitation requires that the target Oracle WebCenter Content instance be accessible over HTTP from the network (AV:N) - typically an intranet or internet-facing deployment. No authentication or prior account is required on the part of the attacker (PR:N). A necessary condition is that a legitimate user with access to Oracle WebCenter Content must interact with attacker-supplied content - for example, by clicking a crafted URL or visiting a page embedding the malicious payload (UI:R); purely automated, unauthenticated exploitation without social engineering is not feasible given this requirement. The vulnerability is present in the Content Server component specifically; deployments that have disabled or restricted access to this component reduce exposure. Both supported release lines (12.2.1.4.0 and 14.1.2.0.0) are affected, so version alone does not limit risk within the supported set. The scope change condition (S:C) implies that other Fusion Middleware components co-located with WebCenter Content may also be affected when exploitation succeeds.

The CVSS 3.1 score of 7.1 (High) is primarily elevated by the scope change and zero-privilege requirement, though the individual C/I/A impact components are each rated Low, which moderates real-world severity compared to a full-compromise scenario. The low attack complexity and lack of required privileges mean that even a mid-sized municipal IT team in sopot operating an internet-exposed WebCenter Content portal should treat this as urgent patching work, since the barrier to exploitation is primarily social engineering rather than technical skill. EPSS data was not supplied, limiting probabilistic exploitation forecasting; however, the Oracle CPU (Critical Patch Update) release cycle for August 2026 confirms vendor acknowledgment and patch availability. No CISA KEV listing and no public POC have been identified, which suggests exploitation has not yet been observed at scale - but the attack profile (low complexity, no authentication, scope change) is attractive to opportunistic actors once details become more widely known. The human interaction requirement (UI:R) is a meaningful limiting factor that prevents fully automated, mass exploitation - this vulnerability cannot be weaponized in a purely autonomous scanning campaign without a social engineering component.

An attacker identifies an internet-accessible Oracle WebCenter Content portal running version 12.2.1.4.0 or 14.1.2.0.0, crafts a malicious HTTP URL or page embedding a payload targeting the Content Server component, and socially engineers an authenticated user - such as a content contributor - into clicking the link or visiting the page. The user's browser processes the injected payload within the WebCenter Content session context, allowing the attacker to read a subset of accessible content, modify or insert records, and degrade service availability for that user, with the scope change potentially extending these impacts to other Fusion Middleware applications sharing trust with the Content Server.