EUVD-2026-106402
GHSA-phq8-3fvx-6286
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
ExploitSend crafted HTTP request to Content Server
-
ExecutionBypass data authorization checks
-
ImpactUnauthorized update/insert/delete of data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged authenticated account on Oracle WebCenter Content (component: Content Server), reachable over HTTP; affected supported version is 12.2.1.4.0. Exploitation is limited by the authentication requirement (PR:L) - it is not usable by fully unauthenticated attackers - and impact is confined to unauthorized update/insert/delete of a subset of accessible data, with no confidentiality or availability effect. No user interaction is needed (UI:N) and attack complexity is low (AC:L). |
| Impact | This is a moderate-severity, low-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) indicates network-reachable, low-complexity exploitation but requires an authenticated low-privileged account (PR:L) and yields only limited integrity impact (I:L) with no confidentiality or availability loss. No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept, so exploitation status is 'no public exploit identified at time of analysis.' All signals are internally consistent and point to low real-world risk: the attacker must already hold valid credentials, and the payoff is limited to unauthorized update/insert/delete of 'some' accessible data. Note a metadata conflict worth verifying: the input Tags include 'Authentication Bypass,' which contradicts the CVSS PR:L and the description's 'low privileged attacker' - this flaw requires authentication, so the tag appears mislabeled. No EPSS, CWE, or detailed patch metadata was supplied beyond the Oracle CPU reference. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged Oracle WebCenter Content account sends crafted HTTP requests to the Content Server to perform unauthorized modification, insertion, or deletion of a subset of application data they should not be able to alter. No user interaction or elevated privileges are needed, but valid authentication is required and no public exploit code is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle WebCenter Content 12.2.1.4.0 (Content Server component) permits an authenticated low-privileged attacker with HTTP network access to perform unauthorized update, insert, or delete operations against a subset of accessible data, with no confidentiality or availability impact. The flaw is low complexity and needs no user interaction, but exploitation requires a valid low-privileged account; no public exploit code or confirmed active exploitation was identified at time of analysis. This is a moderate-severity, low-priority issue rather than an urgent one.
RemediationAI
Apply the Oracle Critical Patch Update October 2026 fix for Oracle WebCenter Content 12.2.1.4.0; the provided data does not specify an exact patched version, so verify the fixed build in the Oracle CPU advisory at https://www.oracle.com/security-alerts/cpuoct2026.html before deployment. Until the update is applied, restrict HTTP access to Content Server to trusted networks or require VPN/allowlisting (may disrupt legitimate remote users), enforce least privilege and review low-privileged accounts and roles that can modify content (may require role redesign), and monitor for anomalous update/insert/delete activity. If business needs permit, temporarily disable unnecessary write operations or custom Content Server endpoints, accepting reduced functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Content is an enterprise content management platform within Oracle Fusion Middleware; the affected Content Server component exposes HTTP interfaces for content operations. The assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N describes a network-reachable, low-complexity authorization/access-control weakness that requires a valid low-privileged session and results only in limited integrity impact (unauthorized update, insert, or delete of some accessible data), with no confidentiality or availability effect. No CWE mapping was provided, and no CPE strings were included; EUVD identifies Oracle WebCenter Content 12.2.1.4.0 as the affected version. The supplied tag 'Authentication Bypass' should not be read as permitting unauthenticated access, because the authoritative assessment requires PR:L; it is more consistent with an authenticated user exceeding intended data-modification privileges. Oracle's October 2026 Critical Patch Update advisory is the vendor reference.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network HTTP vector (AV:N), no special conditions (AC:L), requires a low-privileged authenticated account (PR:L), and only limited integrity impact (I:L) with no C/A effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB