EUVD-2026-106339
GHSA-42xm-v5x3-77mv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
ExploitSend crafted HTTP request to Content Server
-
ExecutionBypass access controls on stored content
-
ImpactExfiltrate critical confidential data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privilege account on the target (CVSS PR:L) plus network HTTP access to the Oracle WebCenter Content Server component; affected supported versions are 12.2.1.4.0 and 14.1.2.0.0. No user interaction and no special non-default configuration is indicated, and attack complexity is low. The primary limiting factor is the authentication requirement - the attacker must first obtain or possess low-privilege credentials, which rules out purely anonymous exploitation despite the 'Authentication Bypass' tag; impact is confined to disclosure of confidential data (no integrity or availability effect). |
| Impact | This is a moderate-priority vulnerability per its CVSS 3.1 base score of 6.5. The vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity, no-user-interaction flaw that an attacker holding low-level privileges (PR:L) can leverage over HTTP to achieve a total loss of confidentiality (C:H) with no integrity or availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the real-world urgency therefore rests on the CVSS characteristics alone rather than any observed attacker interest. The confidentiality-only impact means this is a data-exposure issue, not a code-execution or service-disruption one, which tempers the raw severity. One notable conflict: the input Tags include 'Authentication Bypass', yet the CVSS vector specifies PR:L (valid low-privilege credentials required), which is logically inconsistent with a true pre-authentication bypass - the authoritative Oracle/NVD vector should be treated as correct and the tag as questionable. Verify with the Oracle October 2026 CPU advisory before classifying this as an unauthenticated bypass. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege account on an internet- or intranet-reachable Oracle WebCenter Content instance sends a crafted HTTP request to the Content Server component. Because attack complexity is low and no user interaction is needed, the request returns critical content the account should not be able to read, resulting in full disclosure of all WebCenter Content-accessible data. No public exploit code was identified at time of analysis, so exploitation would require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allow authenticated low-privilege users to read confidential Content Server data over HTTP, with CVSS 3.1 base score 6.5 reflecting high confidentiality impact and no integrity or availability effect. Exploitation requires a valid low-privilege account plus network access to the Content Server component; no user interaction or special configuration is indicated. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
RemediationAI
Patch available per vendor advisory: apply the Oracle Critical Patch Update referenced at https://www.oracle.com/security-alerts/cpuoct2026.html for WebCenter Content 12.2.1.4.0 and 14.1.2.0.0; the provided data does not state an exact fixed build, so confirm the applicable patch level in the Oracle advisory before rollout. If patching is delayed, restrict HTTP access to the Content Server component to trusted networks or VPN, enforce least privilege and review role assignments for low-privilege accounts, and monitor for anomalous bulk content retrieval; network restrictions can break legitimate remote access, and tighter role controls may disrupt existing workflows. No public exploit was identified at time of analysis, but the low attack complexity and PR:L requirement make credential hygiene and access monitoring important compensating controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Content is an Oracle Fusion Middleware product whose Content Server component exposes HTTP interfaces for content management and retrieval. The authoritative CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning an attacker with low-privilege credentials can reach the service over the network and disclose critical data without user interaction. CWE is not provided, so the root-cause class cannot be tied to a specific coding weakness from the available data. Although the supplied tag labels the issue 'Authentication Bypass', the PR:L vector requires a valid low-privilege account and should not be treated as anonymous pre-auth access.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP vector with low complexity and no UI; description explicitly requires a low-privileged attacker, so PR:L; impact is total confidentiality loss only, so C:H and I:N/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB