Oracle WebCenter Content EUVD-2026-37302

No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Content: Imaging 12.2.1.4.0 or 14.1.2.0.0 reachable over HTTP, with no user interaction required (AV:N/AC:L/PR:N/UI:N). Practical limits are that the Imaging HTTP endpoint must be network-reachable by the attacker (typically deployed on WebLogic; many enterprise installs are intranet-only or fronted by SSO/reverse proxies that may not pass the unauthenticated path), and only the Imaging component is in scope - other WebCenter Content modules are not stated to be affected. Availability impact is N, so this is a read/tamper condition, not a service-disruption one.

CVSS 3.1 9.1 with AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N indicates a high-severity, low-complexity, fully unauthenticated network attack - exactly the profile that defenders should treat as priority for any internet- or partner-network-exposed Imaging instance. EPSS and CISA KEV signals are absent from the provided intelligence, and no public exploit identified at time of analysis, so the current risk is driven by intrinsic exploitability rather than observed in-the-wild activity; this can change quickly after Oracle CPU disclosure, which historically attracts reverse-engineering of patches. The A:N rating means denial of service is not the threat, but unauthorized data disclosure and tampering of all Imaging-accessible records (which can include sensitive scanned documents, invoices, HR forms) is, making this a material confidentiality/integrity concern even though raw severity slightly understates the data-sensitivity context.

An attacker who can reach the WebCenter Content: Imaging HTTP endpoint over the network sends crafted HTTP requests to the vulnerable Core component without supplying valid credentials, abusing the missing authentication enforcement to read stored documents and metadata or to create, modify, and delete Imaging records. Because availability is not impacted, the activity may go unnoticed while sensitive scanned content (invoices, contracts, HR documents) is exfiltrated or tampered with. No public exploit identified at time of analysis, but the low attack complexity and PR:N rating make weaponization straightforward once patches are diffed.