What is the CVSS score of EUVD-2026-37301?

EUVD-2026-37301 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by EUVD-2026-37301?

Oracle WebCenter Content: Imaging (versions 12.2.1.4.0 and 14.1.2.0.0) is vulnerable to remote unauthenticated takeover enabling complete system compromise through network access alone, without…

How to fix or mitigate EUVD-2026-37301?

24 hours: Identify all systems running Oracle WebCenter Content: Imaging versions 12.2.1.4.0 or 14.1.2.0.0; document network exposure and data sensitivity of affected systems. 7 days: Implement firewall rules to restrict inbound access to affected systems; disable internet-facing access where operationally feasible; enable detailed audit logging. 30 days: Monitor Oracle's June 2026 Critical Patch Update advisories for patch release details; plan and execute migration to patched versions; if patching is delayed beyond 90 days, escalate for alternative platform evaluation.

Oracle WebCenter Content EUVD-2026-37301

| CVE-2026-46783 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Oracle Webcenter Content Authentication Bypass

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated HTTP exploitation is easy and results in product takeover, justifying AV:N/AC:L/PR:N/UI:N with full C/I/A impact and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:06 vuln.today

DescriptionCVE.org

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebCenter Content: Imaging. Successful attacks of this vulnerability can result in takeover of WebCenter Content: Imaging. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote unauthenticated takeover of Oracle WebCenter Content: Imaging (versions 12.2.1.4.0 and 14.1.2.0.0) is possible via HTTP, per Oracle's June 2026 Critical Patch Update. With a CVSS 3.1 base score of 9.8 and AV:N/AC:L/PR:N/UI:N, the flaw in the Core component enables full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Content: Imaging is the document imaging and capture module within Oracle Fusion Middleware's WebCenter Content suite, used for enterprise document management, invoice processing, and records workflows. The CPE 'cpe:2.3:a:oracle_corporation:webcenter_content:_imaging' confirms the Imaging-specific component within the broader WebCenter Content product is in scope, specifically its Core subsystem reachable over HTTP. No CWE has been assigned by Oracle, but the combination of network vector, low complexity, no privileges, and a full triad impact is characteristic of unauthenticated request-handling flaws such as deserialization, authentication bypass, or injection in the application's HTTP-facing endpoints - common patterns in prior Oracle Fusion Middleware advisories.

RemediationAI

Patch available per vendor advisory: apply the fixes shipped in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) for WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0; no exact post-patch build number was provided in the supplied data, so confirm the specific bundle patch in Oracle's CPU matrix before deploying. As compensating controls until the CPU is applied, restrict network access to the WebCenter Content: Imaging HTTP and managed-server ports so that only trusted application tiers and administrative jump hosts can reach them - accepting that legitimate document submission/imaging integrations from end users or partners will break until reopened - and place the service behind a reverse proxy or WAF that enforces authentication at the edge, acknowledging this does not address the root cause and may be bypassed if backend ports remain exposed. Increase HTTP access logging on the Imaging managed servers and monitor for anomalous requests to Imaging endpoints to detect attempted exploitation.