EUVD-2026-106419
GHSA-r3j2-f4hq-9jm5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
ExploitReach SOAP interface over network
-
ExecutionSend crafted SOAP request
-
ImpactObtain unauthorized read of data subset
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to possess valid low-privileged credentials on Oracle WebCenter Content: Imaging (PR:L) and network reachability to the product's SOAP interface; exploitation then yields read-only access to a subset of Imaging data. Limiting factors: pre-existing authentication is mandatory (not exploitable by anonymous/unauthenticated users), the SOAP endpoint must be network-exposed to the attacker, and impact is confined to confidentiality of a data subset with no write or denial-of-service capability. Affected deployments are limited to versions 12.2.1.4.0 and 14.1.2.0.0. |
| Impact | This is a moderate, low-severity confidentiality issue rather than an urgent priority. The CVSS 3.1 base score of 4.3 is driven entirely by limited confidentiality impact (C:L/I:N/A:N) with no integrity or availability effect. The vector (AV:N/AC:L/PR:L/UI:N/S:U) indicates network-reachable, low-complexity exploitation via SOAP, but critically requires pre-existing low-level privileges (PR:L) - meaning an attacker must already be an authenticated user. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or probable near-term exploitation. SIGNAL CONFLICT: the input Tag 'Authentication Bypass' directly contradicts the CVSS vector and description, which require a low-privileged (authenticated) attacker (PR:L) and yield only a read of a data subset - this is not an authentication bypass and the tag appears mislabeled. Net assessment: patch in normal Oracle CPU cadence; this is a high-CVSS-but-this-is-actually-low-real-risk, authenticated, read-only information-disclosure flaw, not a critical remote-takeover issue. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged application account on Oracle WebCenter Content: Imaging sends crafted requests to the product's network-accessible SOAP interface. The flaw allows them to read a subset of Imaging data they should not be authorized to access, resulting in limited information disclosure. No public exploit code is identified in the available data, and exploitation yields read-only access with no integrity or availability impact. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle WebCenter Content: Imaging versions 12.2.1.4.0 and 14.1.2.0.0 contain a low-severity confidentiality flaw in the Core component exposed through SOAP. An attacker who already holds valid low-privileged credentials and can reach the SOAP interface can read a subset of Imaging data they should not access (CVSS 4.3), with no write or denial-of-service impact. No public exploit code has been identified at time of analysis.
RemediationAI
Apply the Oracle Critical Patch Update referenced in the vendor advisory at https://www.oracle.com/security-alerts/cpuoct2026.html; the provided data does not specify an exact patched build, so confirm the fixed release in the advisory before upgrading. Until patched, restrict network access to the Imaging SOAP endpoint to trusted hosts and integrations, noting that this can break legitimate SOAP clients; remove or reduce low-privileged accounts that do not require Imaging access, with the trade-off of impacting existing user workflows; and monitor SOAP requests for anomalous read patterns. No vendor workaround is documented in the provided data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is Oracle Fusion Middleware WebCenter Content: Imaging, specifically its Core component and SOAP service interface. The authoritative CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N: network-reachable, low attack complexity, requires low privileges (PR:L), no user interaction, scope unchanged, and only low confidentiality impact. No CWE is assigned in the provided data; the PR:L and C:L characteristics are consistent with an authorization/access-control weakness in SOAP operations that return Imaging data beyond the intended scope for a low-privileged user. Although the source tags include 'Authentication Bypass', the assessed prerequisites require valid low-privileged credentials, so this is best characterized as an authenticated data-exposure/authorization issue rather than a pre-auth bypass.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable SOAP interface (AV:N) with no special complexity (AC:L) but requires a low-privileged authenticated account (PR:L); only a subset of data is readable (C:L), with no integrity or availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise WebCenter Content: Imaging. Successful attacks of this vulnerability can result in unauthorized read access to a subset of WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB