EUVD-2026-106740
GHSA-p9cr-vwph-w89h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed WebCenter Content Server
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitExploit Content Server flaw
-
ExecutionAchieve code execution/takeover
-
ImpactExfiltrate or alter managed content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against the Content Server component of Oracle WebCenter Content (affected versions 12.2.1.4.0 and 14.1.2.0.0), per AV:N/AC:L/PR:N/UI:N. The primary limiting factor is network exposure: the Content Server HTTP endpoint must be reachable by the attacker, so instances restricted to internal networks or behind access controls face reduced exposure. Exploitation is version-bounded to the two listed releases; environments already on the October 2026 CPU patch level are not affected. |
| Impact | This is a genuine high-priority issue, not a high-CVSS-but-low-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, pre-authentication vulnerability with high impact to confidentiality, integrity, and availability, and the description reinforces this by stating an unauthenticated attacker with HTTP network access can achieve full takeover of Oracle WebCenter Content. The combination of no privileges, no user interaction, and 'easily exploitable' wording is the classic profile of a flaw that becomes a mass-scanning target once a PoC appears. However, several real-world risk signals are MISSING from the input: no EPSS exploitation-probability score is provided, the CVE is not listed in CISA KEV, and no public exploit (PoC) is referenced. SSVC inputs (exploitation status, automatable, technical impact) are also not supplied. Technical impact is clearly 'total' per the vector, and the vulnerability is likely 'automatable' given AV:N/PR:N, but 'exploitation' status should be treated as 'none observed' based on available data. Net: prioritize patching on the basis of the severe vector and pre-auth takeover, while recognizing that active-exploitation and probability signals are absent rather than confirming low risk. |
| Exploit ScenarioDerived | An attacker with network access to the Oracle WebCenter Content Server HTTP interface sends a crafted unauthenticated request that exploits the Content Server component, requiring no credentials or user interaction. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with full C/I/A impact, a single successful request can lead to complete compromise and takeover of the WebCenter Content instance. No public exploit code is identified in the provided data, so exploitation would currently require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Remote, unauthenticated takeover of Oracle WebCenter Content is possible through the Content Server component over HTTP, with CVSS 3.1 score 9.8 affecting versions 12.2.1.4.0 and 14.1.2.0.0. The attack requires only network reachability to the Content Server endpoint and no credentials or user interaction, yielding high confidentiality, integrity and availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, but the exposure is serious for internet-facing instances and should be prioritized.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html); patch status is 'Patch available per vendor advisory' and the exact fixed build is not enumerated in the supplied data, so verify the corrected release in the advisory before upgrading. Until patched, reduce exposure by restricting network access to the Content Server HTTP endpoint to trusted networks or VPN users, placing it behind an authenticating reverse proxy or WAF, and removing direct internet reachability; these controls can break legitimate remote access and require proxy/WAF tuning. Monitor web access logs for anomalous requests to Content Server, and prioritize internet-facing 12.2.1.4.0 and 14.1.2.0.0 instances.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Content is an enterprise content management platform in Oracle Fusion Middleware; the affected Content Server component exposes HTTP services. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a remotely reachable, low-complexity, unauthenticated path requiring no user interaction, with full loss of confidentiality, integrity and availability. The feed assigns no CWE and does not disclose the exact flaw, so the root-cause class cannot be confirmed; exploitation is version-bounded to 12.2.1.4.0 and 14.1.2.0.0, and the primary exposure condition is that the Content Server HTTP endpoint be reachable by the attacker. No CPE mappings were supplied.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description confirms unauthenticated HTTP network access (AV:N, PR:N, UI:N), easy exploitation (AC:L), and full takeover of a single product (S:U, C/I/A:H).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Content (Content Server) versions 12.2.1.4.0 and 14.1.2.0.0 are exposed to a critical remote takeover condition over HTTP, putting enterprise content confidentiality, integrity, and availability at risk. No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, but internet-facing instances represent the highest organizational exposure and require immediate containment and leadership visibility. Prioritize inventory and network restriction of affected deployments while Oracle remediation is pending.
No vendor-released patch identified at time of analysis; restrict network access to Content Server endpoints via firewall/ACL, deploy WAF/IPS virtual patching, require VPN or zero-trust access, segment affected instances, monitor HTTP logs, and maintain offline backups.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB