Oracle WebCenter Content EUVD-2026-37295

Exploitation requires only network reachability to the Oracle WebCenter Content Server HTTP interface on a deployment running supported version 12.2.1.4.0 or 14.1.2.0.0; no authentication, no user interaction, and no special non-default configuration are called out by Oracle, consistent with PR:N/UI:N/AC:L. Limiting factors are therefore deployment-scope rather than feature-flag: the Content Server HTTP listener must be reachable from the attacker (internet-exposed instances, partner VPNs, or any LAN-resident attacker qualify), the instance must be on one of the two named supported branches (unsupported older releases are not confirmed vulnerable by this advisory), and impact is bounded to data the Content Server itself can access (A:N - no native availability impact, and S:U - no scope change to other components).

All signals point in the same direction: the CVSS vector AV:N/AC:L/PR:N/UI:N is the worst-case exposure profile (network, low complexity, no privileges, no user interaction), the scope is unchanged but C:H/I:H means full read and write over Content Server data, and Oracle itself describes it as 'easily exploitable'. The lack of A:H keeps the score at 9.1 instead of 9.8, but for a document repository the confidentiality and integrity impact is the dominant concern. EPSS, KEV status, and POC availability were not provided in the intelligence set; absence of a KEV entry and no observed public exploit means there is no public exploit identified at time of analysis, but Oracle Fusion Middleware Content Server has a long history of post-CPU weaponization (e.g., prior WebCenter and WebLogic flaws appearing in KEV within weeks), so the realistic exploitation window after Oracle's June 2026 CPU is short. Treat as a real priority for any internet-exposed or partner-accessible deployment.

An attacker who can reach the Oracle WebCenter Content Server over HTTP sends a crafted request to a Content Server endpoint that the authentication layer fails to gate properly, and is treated as a privileged user. From that single request they can enumerate, exfiltrate, modify, or delete managed documents - for example pulling HR or contract records out of a corporate document repository, or tampering with regulated records to defeat integrity controls. No public exploit identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N profile means a working request is likely to be a single HTTP call once the bypass path is reverse-engineered from the patch diff.