WebCenter Content Imaging EUVD-2026-106415

Exploitation requires network access to the WebCenter Content: Imaging HTTP interface and a valid low-privileged account on the application (CVSS PR:L), so an attacker must already be authenticated at some minimal level; it is not remote-unauthenticated. No user interaction is needed and attack complexity is low, meaning any holder of a low-privilege credential can likely trigger it reliably. The limiting factors are the credential requirement and the affected-version scope (Oracle WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0); impact is confined to confidentiality (reading critical/all Imaging-accessible data) with no integrity or availability effect.

This is a moderate-risk, confidentiality-only vulnerability that warrants prompt but not emergency patching. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable HTTP flaw with low attack complexity requiring only low-level privileges (PR:L) and no user interaction, yielding high confidentiality impact with no integrity or availability effect. No EPSS score, CISA KEV listing, or public POC was provided, so exploitation signals are absent - the current evidence points to 'no public exploit identified at time of analysis' rather than active or likely imminent exploitation. There is a notable conflict in the metadata: the input Tags include 'Authentication Bypass,' yet the CVSS vector specifies PR:L (an already-authenticated low-privileged attacker) and the Oracle description makes no mention of bypassing authentication - these are contradictory, and the 'Authentication Bypass' characterization appears unsupported by the authoritative Oracle/NVD data. Net: a real but bounded priority - a credentialed attacker reading critical data - not a high-CVSS-but-trivial issue, but also not confirmed to be under attack; because it ships in the Oracle October 2026 Critical Patch Update, treat it as routine-urgent patch management.

A low-privileged but authenticated user (for example, a limited application account) sends crafted HTTP requests to the WebCenter Content: Imaging Core component and leverages the flaw to read documents and data they should not be able to access, up to all data reachable by the Imaging service. Because attack complexity is low and no user interaction is needed, exploitation is straightforward once the attacker holds any valid low-privilege credential. No public exploit code was identified in the provided intelligence.