WebCenter Imaging EUVD-2026-106433

Exploitation requires an authenticated low-privileged account (PR:L) on the target and network access to the WebCenter Content: Imaging SOAP web-service interface of the Core component; the specific condition is the ability to reach and invoke SOAP operations against Oracle WebCenter Content: Imaging 14.1.2.0.0. Limiting factors: the attacker must already possess valid credentials (not fully anonymous), and only the Imaging product's integrity is at risk - there is no confidentiality or availability impact and no user interaction is needed. Real-world exposure is highest where the Imaging SOAP endpoint is reachable by many lower-tier or multi-tenant users; it is substantially reduced where the endpoint is network-segmented or restricted to trusted administrators.

This is a moderate-priority vulnerability (CVSS 3.1 base 6.5) whose signals are internally consistent but point to a targeted rather than mass-exploitation threat. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) describes a network-reachable, low-complexity attack requiring only low privileges (PR:L) and no user interaction, with impact limited to integrity (I:H) - no confidentiality or availability loss. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided, so there is no evidence of active or probable near-term exploitation; exploitation status is 'no public exploit identified at time of analysis.' The authenticated-but-low-privilege requirement (PR:L) meaningfully constrains real-world risk: an attacker must already hold a valid, if unprivileged, account on the WebCenter Content: Imaging instance. Note a likely metadata conflict: the input Tag 'Authentication Bypass' contradicts the CVSS vector, which requires privileges (PR:L) and therefore is NOT an authentication bypass - verify the tag against the Oracle advisory. Because integrity-only Oracle Fusion Middleware flaws are rarely mass-exploited and this one needs prior authentication, treat it as an important patch-cycle item (Oracle CPU October 2026) rather than an emergency, prioritizing internet-exposed or multi-tenant Imaging deployments.

A low-privileged user with a valid account on an internet- or intranet-reachable WebCenter Content: Imaging instance sends a crafted SOAP request to the Core component that bypasses object-level authorization checks. The request creates, modifies, or deletes critical imaging data the attacker should not be able to touch, corrupting business records without affecting confidentiality or availability. No public exploit code or active exploitation has been identified; the low attack complexity (AC:L) means a working exploit would be straightforward once the exact SOAP operation is known.