EUVD-2026-106406
GHSA-vm2h-7mx8-2gmj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
ExploitSend crafted HTTP request to Content Server
-
ExecutionTrigger hang or repeatable crash
-
ImpactComplete denial of service of WebCenter Content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged account on the target Oracle WebCenter Content instance (CVSS PR:L) and network HTTP access to the Content Server component; no user interaction or elevated privileges are needed and attack complexity is low. The practical limiting factors are: the attacker must first authenticate, so exposure is highest where low-privileged accounts are widely issued or self-registration is enabled, and where the HTTP interface is reachable from untrusted networks. Only Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 are stated as affected. The impact is confined to availability (service hang/crash), with no data exposure or modification. |
| Impact | This is a moderate, availability-only risk that should not be treated as a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 6.5 and tells a consistent story: an attacker needs only network HTTP reach and low privileges (PR:L - a valid, low-privileged account), no user interaction, and low attack complexity, but the sole consequence is a complete denial of service (A:H) with no confidentiality or integrity impact (C:N/I:N). No EPSS score is provided in the input, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent - there is no network-vs-local conflict here - but the requirement for an authenticated account (PR:L) meaningfully limits the attacker population compared to a PR:N flaw, and the impact ceiling is service outage only, not compromise. Net: prioritize patching for internet-facing or multi-tenant WebCenter Content instances where low-privileged accounts are broadly provisioned, but it is a lower priority than any confidentiality/integrity or unauthenticated issue in the same Oracle Critical Patch Update. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged WebCenter Content account sends a crafted HTTP request to the Content Server component, triggering a hang or repeatable crash that takes the content management service fully offline. Because attack complexity is low and no user interaction is needed, the request can be scripted and repeated to sustain the outage. No public proof-of-concept exploit is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Denial of service in Oracle WebCenter Content's Content Server component lets an authenticated low-privileged attacker with network HTTP access hang or repeatedly crash the application, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 score is 6.5 with availability-only impact (A:H; no confidentiality or integrity effect), and no public exploit code or CISA KEV entry was identified at time of analysis. This is a moderate availability risk rather than a top-tier emergency, but it is easily triggered once valid low-privileged credentials exist.
RemediationAI
The supplied data points to Oracle's Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpuoct2026.html as the remediation reference, but it does not state an exact fixed build, so confirm the patched release for 12.2.1.4.0 and 14.1.2.0.0 in that advisory before upgrading. Until patching is complete, reduce exposure by restricting network access to the Content Server HTTP interface to trusted networks or required integrations-accepting that this can break legitimate remote access and partner integrations-and by tightening account governance: disable self-registration where it is enabled, review and reclaim unnecessary low-privileged accounts, and enforce strong authentication, with the trade-off that these controls may slow onboarding and require helpdesk involvement. Monitor for repeated service hangs or crashes and alert on abnormal request patterns from low-privileged accounts, since detection depends on availability symptoms rather than data-loss indicators.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Content is an enterprise content management platform within Oracle Fusion Middleware, and the affected Content Server component is the HTTP-facing service that handles content requests. The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) describes a low-complexity network attack that requires a valid low-privileged account but no user interaction or elevated rights, and the resulting impact is limited to availability: a hang or frequent repeatable crash. No CWE mapping was supplied, so the precise implementation flaw cannot be confirmed from the available data; the advisory and EUVD entry only identify the affected releases 12.2.1.4.0 and 14.1.2.0.0. Because confidentiality and integrity impacts are absent, the vulnerability should be scoped as a denial-of-service condition rather than a data breach or code-execution issue.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network HTTP vector (AV:N) with low complexity (AC:L) but a required low-privileged account (PR:L); impact is a complete DOS so A:H with C:N/I:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebCenter Content. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB