EUVD-2026-37304Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-reachable HTTP endpoint with no attacker auth (AV:N/PR:N), low complexity, but requires a victim user interaction (UI:R); takeover crossing into other Fusion Middleware justifies S:C and C/I/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
AnalysisAI
Account takeover in Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows a remote unauthenticated attacker to fully compromise the product when a victim user is tricked into interacting with attacker-supplied content over HTTP. The scope-changing flaw carries a CVSS 3.1 base score of 9.6 with high confidentiality, integrity, and availability impact, and there is no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) network reachability to a vulnerable Oracle WebCenter Content 14.1.2.0.0 Content Server over HTTP/HTTPS, and (2) a human victim other than the attacker - typically an authenticated WebCenter user or administrator - to perform an interaction such as clicking a crafted link, loading attacker-supplied content, or visiting an attacker-controlled page while logged into Content Server (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed but lean toward elevated priority for any internet- or intranet-exposed WebCenter Content deployment: CVSS 3.1 is 9.6 (Critical) with low attack complexity, no privileges, network vector, and scope change driving the high score, but UI:R means the chain depends on tricking a human - typically a content author or administrator - into clicking or rendering attacker content. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious URL or document referencing a Content Server endpoint and delivers it via phishing to a logged-in WebCenter administrator; when the administrator opens the link in an authenticated browser session, the flaw executes attacker-controlled actions in the victim's context, leading to full takeover of the WebCenter Content instance and, because of the scope change, impact on other Fusion Middleware resources reachable from that session. No public exploit identified at time of analysis, so the chain is currently theoretical, but the low attack complexity and the predictable structure of Content Server URLs make weaponization straightforward once details are published. |
| Remediation | Apply Oracle's June 2026 Critical Patch Update for Oracle WebCenter Content as documented at https://www.oracle.com/security-alerts/cspujun2026.html (Patch available per vendor advisory; an exact post-patch build string is not provided in the input and should be taken from the Oracle CPU patch availability table for 14.1.2.0.0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems running Oracle WebCenter Content 14.1.2.0.0 and assess exposure in production environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) allows a low-privilege
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged remote attacker over HT
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker sending HTTP req
Remote takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to fully
Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via the Content Server
Share
External POC / Exploit Code
Leaving vuln.today