EUVD-2026-37306Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
HTTP-reachable Content Server gives AV:N/AC:L; Oracle requires a high-privileged operator account (PR:H) and interaction by a second user (UI:R); scope change with full takeover yields S:C and C/I/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H).
AnalysisAI
Takeover of Oracle WebCenter Content 14.1.2.0.0 is possible when a high-privileged attacker over HTTP induces a separate user to interact with crafted content, resulting in full confidentiality, integrity, and availability compromise plus impact on adjacent products via CVSS scope change. The Oracle Critical Patch Update (June 2026) lists this in the Content Server component with a CVSS 3.1 base score of 8.4. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) the target running Oracle WebCenter Content 14.1.2.0.0 with the Content Server component reachable over HTTP, (2) the attacker already holding high privileges on WebCenter Content (PR:H - typically an administrative or content-manager role, not an anonymous web user), and (3) a second human user - distinct from the attacker - performing an interaction such as opening, previewing, or approving the attacker-staged content (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is meaningful but bounded: the CVSS 3.1 vector AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H yields 8.4 because of the scope change and full CIA impact, yet exploitation requires both high privileges on WebCenter Content and interaction from a different user, which significantly narrows the attacker population to insiders or compromised administrative accounts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A compromised or malicious WebCenter Content administrator authenticates over HTTP and stages a crafted document, configuration, or link in the Content Server; when a separate user (for example, a reviewer or a downstream system operator) opens or processes that item, the payload executes in their context and pivots into adjacent Fusion Middleware products via the CVSS scope change, ultimately yielding takeover of WebCenter Content. No public exploit identified at time of analysis, so the scenario relies on insider abuse or chained credential theft rather than off-the-shelf tooling. |
| Remediation | Apply the fixes shipped in the Oracle Critical Patch Update of June 2026 referenced at https://www.oracle.com/security-alerts/cspujun2026.html; the specific patched build for WebCenter Content 14.1.2.0.0 is the CPU-listed patch level for that release (patch available per vendor advisory, exact post-patch version string not independently confirmed in the supplied data). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify and inventory all systems running Oracle WebCenter Content 14.1.2.0.0; audit current user privilege levels and document external network connectivity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) allows a low-privilege
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged remote attacker over HT
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker sending HTTP req
Remote takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to fully
Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via the Content Server
Share
External POC / Exploit Code
Leaving vuln.today