Oracle WebCenter Content EUVD-2026-37306

Exploitation requires (1) the target running Oracle WebCenter Content 14.1.2.0.0 with the Content Server component reachable over HTTP, (2) the attacker already holding high privileges on WebCenter Content (PR:H - typically an administrative or content-manager role, not an anonymous web user), and (3) a second human user - distinct from the attacker - performing an interaction such as opening, previewing, or approving the attacker-staged content (UI:R). Limiting factors that defenders should weigh: the attack cannot be executed by an unauthenticated internet user, cannot be fully automated end-to-end because it depends on a victim's action, and is constrained to the single supported version 14.1.2.0.0 named by Oracle; however, AC:L means that once the privileged foothold and victim interaction exist, no special timing or environmental race is needed.

Real-world risk is meaningful but bounded: the CVSS 3.1 vector AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H yields 8.4 because of the scope change and full CIA impact, yet exploitation requires both high privileges on WebCenter Content and interaction from a different user, which significantly narrows the attacker population to insiders or compromised administrative accounts. There is no EPSS score, KEV listing, or POC reported in the supplied intelligence, so this is not a 'drop everything' issue comparable to unauthenticated RCE in the same product family; however, because successful exploitation produces takeover and affects additional downstream products, organizations with multi-tenant or federated content workflows should treat it as a high-priority patch rather than a theoretical issue. Note that the 'Information Disclosure' tag understates the actual CIA:H impact described by Oracle and should not be relied on for prioritization.

A compromised or malicious WebCenter Content administrator authenticates over HTTP and stages a crafted document, configuration, or link in the Content Server; when a separate user (for example, a reviewer or a downstream system operator) opens or processes that item, the payload executes in their context and pivots into adjacent Fusion Middleware products via the CVSS scope change, ultimately yielding takeover of WebCenter Content. No public exploit identified at time of analysis, so the scenario relies on insider abuse or chained credential theft rather than off-the-shelf tooling.