EUVD-2026-106515
GHSA-rcg4-q8c6-3w4p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
ExploitSend crafted HTTP request to Content Server
-
ExecutionWin high-complexity race/condition
-
ImpactRead unauthorized subset of content data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a valid low-privileged account on the target Oracle WebCenter Content 14.1.2.0.0 Content Server (PR:L - not unauthenticated despite the misleading tag), and (2) satisfying a high-complexity condition that Oracle itself describes as 'difficult to exploit' (AC:H), meaning success is not reliable and likely depends on specific timing or state the attacker cannot fully control. No user interaction is needed (UI:N) and the attack is deliverable remotely over HTTP (AV:N). Limiting factors: the mandatory pre-existing authenticated access, the high attack complexity, the narrow outcome (read access to only a subset of data, no write or availability impact), and that only version 14.1.2.0.0 is listed as affected. |
| Impact | This is a genuinely low-priority vulnerability across nearly every signal. The vendor CVSS 3.1 score is only 3.1 (Low), and the vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms why: although it is reachable over the network via HTTP, Oracle explicitly states it is 'difficult to exploit' (AC:H), requires an already-authenticated low-privileged account (PR:L), and yields only limited, read-only access to a subset of data (C:L; no integrity or availability impact). No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public proof-of-concept referenced, so this is neither known-exploited nor known to have public exploit code. No SSVC decision data was supplied. The one notable conflict is the input Tag 'Authentication Bypass', which contradicts the CVSS vector and description: a true authentication bypass would imply PR:N and broader impact, whereas this flaw presupposes an authenticated low-privileged attacker and leaks only a subset of data - the tag appears mislabeled and should not be used to escalate priority. Net assessment: a low-severity information-disclosure issue suitable for routine patching in the next Oracle CPU cycle, not an emergency. |
| Exploit ScenarioDerived | An attacker who already holds a valid low-privileged account on an Oracle WebCenter Content 14.1.2.0.0 instance sends specially crafted HTTP requests to the Content Server component, winning a difficult-to-trigger condition (AC:H) that returns a subset of content data they should not be able to read. No public exploit code is referenced, and success is probabilistic rather than reliable given the high attack complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle WebCenter Content 14.1.2.0.0 (Content Server component of Oracle Fusion Middleware) allows a low-privileged authenticated user with network access over HTTP to read a limited subset of content the account should not be able to see, but only when a high-complexity condition is satisfied - Oracle itself classifies the issue as 'difficult to exploit.' The impact is confidentiality-only (CVSS 3.1 base score 3.1, AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), with no write, integrity, or availability effect, and exploitation requires a pre-existing valid account despite a third-party tag labeling it an authentication bypass. No public exploit code or confirmed active exploitation (CISA KEV) was identified in the available intelligence at time of analysis, and this is a genuinely low-priority issue across nearly every risk signal.
RemediationAI
Apply the fix from Oracle's October 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor channel for WebCenter Content 14.1.2.0.0; no exact patched build number is published in the supplied intelligence, so confirm the minimum CPU/patch-set level in My Oracle Support against your installed 14.1.2.0.0 build before closing the finding (patch status: patch available per vendor advisory). Because exploitation requires a valid low-privileged account plus a hard-to-satisfy condition, the practical risk reduction levers are exposure and privilege based: restrict HTTP access to the Content Server to trusted network ranges via firewall ACLs or a reverse proxy, accepting that this breaks legitimate external/partner access workflows; enforce least privilege and periodic review of WebCenter Content accounts and roles, removing dormant or over-provisioned users, with the trade-off of added administrative overhead; and monitor Content Server access logs for anomalous retrieval patterns from low-privileged accounts. Oracle CPUs typically ship without workarounds, so no vendor-supported configuration toggle is documented for this issue - do not attempt to disable core Content Server retrieval features as a substitute for patching. Given the low severity and absence of public exploit code or KEV listing, emergency out-of-band action is not warranted; fold the update into the next scheduled patch cycle.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WebCenter Content is Oracle's enterprise content and document management platform; the Content Server component handles document ingestion, storage, metadata search, and HTTP-based retrieval for authenticated users. This CVE is an information-disclosure weakness in how the Content Server enforces access boundaries on a subset of stored content: the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) describes a remote, network-delivered attack over HTTP that requires an attacker to already hold a valid low-privileged account (PR:L) and to satisfy a high-complexity precondition (AC:H) that Oracle describes as difficult to reproduce reliably - typically a race, ordering, or specific object-state dependency the attacker cannot fully control. No user interaction is required and the scope remains unchanged, so the flaw does not let the attacker escape the Content Server's security authority; the outcome is bounded unauthorized read access to only a subset of WebCenter Content data. No CWE was assigned in the supplied data, and Oracle Critical Patch Update advisories deliberately withhold root-cause detail until customers have had time to patch, so the precise code defect (for example an authorization check applied inconsistently to a particular content-retrieval path) is not publicly documented. Note the external 'Authentication Bypass' tag conflicts with the assessed vector: PR:L means an account is mandatory, so this is an authorization/information-disclosure flaw, not a bypass of authentication.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Remote HTTP reach (AV:N) but vendor-stated difficult exploitation (AC:H) and a required low-privileged account (PR:L); only a limited confidentiality leak, so C:L and I/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB