Oracle WebCenter Content EUVD-2026-37301

No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Content: Imaging 12.2.1.4.0 or 14.1.2.0.0, requiring only network reachability to the product's HTTP interface (CVSS AV:N/AC:L/PR:N/UI:N). Limiting factors are that the attacker must be able to reach the Imaging HTTP listener (typically an internal Fusion Middleware managed-server port that is not always exposed to the public internet) and that only the two listed Fusion Middleware versions are confirmed in scope; deployments where Imaging is fronted by an authenticating reverse proxy or restricted to internal VLANs raise the practical barrier even though CVSS still reflects PR:N.

All available signals point to a high-priority issue: CVSS 3.1 is 9.8 with AV:N/AC:L/PR:N/UI:N (network-reachable, no authentication, no user interaction), and Oracle itself describes the flaw as 'easily exploitable' resulting in 'takeover'. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here, and CISA KEV does not list this CVE at time of analysis, meaning active exploitation is not confirmed. No POC has been published in the supplied references. The conflict to flag is that Oracle CPU scoring historically reflects worst-case theoretical impact, while real-world exposure depends on whether the Imaging HTTP listener is internet-facing; defenders should still treat this as critical patch-now material due to the unauthenticated network vector against an enterprise content platform.

An attacker on any network path that can reach the WebCenter Content: Imaging HTTP listener sends a single crafted HTTP request to a vulnerable endpoint in the Core component, requiring no credentials and no user interaction. The request triggers the flaw and yields full takeover of the Imaging service, allowing the attacker to read or modify scanned documents, pivot into integrated WebCenter Content repositories, and use the compromised host as a foothold into the broader Fusion Middleware estate. No public exploit identified at time of analysis, but the low complexity and Oracle's 'easily exploitable' wording suggest weaponization is plausible once details emerge.