What is the CVSS score of EUVD-2026-37306?

EUVD-2026-37306 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by EUVD-2026-37306?

Oracle WebCenter Content 14.1.2.0.0 contains an unpatched critical vulnerability (CVSS 8.4) that could enable attackers with high-level system access to achieve complete control over platform data,…

How to fix or mitigate EUVD-2026-37306?

24 hours: Identify and inventory all systems running Oracle WebCenter Content 14.1.2.0.0; audit current user privilege levels and document external network connectivity. 7 days: Implement network-level access controls restricting HTTP connectivity to WebCenter Content; reduce high-privileged account count via least-privilege audit; enable comprehensive HTTP logging with real-time alerting. 30 days: Monitor Oracle Critical Patch Updates for version-specific remediation; prepare to deploy patches within 48 hours of release; validate compensating controls through security assessment.

Oracle WebCenter Content EUVD-2026-37306

| CVE-2026-46788 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

8.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.4 HIGH

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.4 HIGH

HTTP-reachable Content Server gives AV:N/AC:L; Oracle requires a high-privileged operator account (PR:H) and interaction by a second user (UI:R); scope change with full takeover yields S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:03 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle WebCenter Content 14.1.2.0.0 is possible when a high-privileged attacker over HTTP induces a separate user to interact with crafted content, resulting in full confidentiality, integrity, and availability compromise plus impact on adjacent products via CVSS scope change. The Oracle Critical Patch Update (June 2026) lists this in the Content Server component with a CVSS 3.1 base score of 8.4. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.

Technical ContextAI

The flaw resides in the Content Server component of Oracle WebCenter Content, the document and records management platform within Oracle Fusion Middleware used to store, classify, and deliver enterprise content over HTTP. CPE data confirms the vulnerable product as oracle_corporation:oracle_webcenter_content, with Oracle naming 14.1.2.0.0 as the affected supported release. No CWE is published by Oracle for this entry, but the CVSS scope change (S:C) combined with required user interaction is consistent with a server-side injection or stored-content flaw where attacker-controlled data placed by a privileged user is later rendered or processed in a victim's security context, allowing the attack to break out of the Content Server's authorization boundary into downstream products that consume the content.

RemediationAI

Apply the fixes shipped in the Oracle Critical Patch Update of June 2026 referenced at https://www.oracle.com/security-alerts/cspujun2026.html; the specific patched build for WebCenter Content 14.1.2.0.0 is the CPU-listed patch level for that release (patch available per vendor advisory, exact post-patch version string not independently confirmed in the supplied data). Until the CPU can be deployed, reduce the population of accounts holding high privileges on Content Server, require step-up authentication and session isolation for those accounts, and restrict HTTP access to the Content Server administrative and contribution endpoints to a management VLAN or VPN - accepting that this will block legitimate remote contributors. Additionally, audit and tighten content rendering and link-handling settings so that artifacts uploaded by privileged users are not auto-previewed by other users, which directly disrupts the required UI:R step, at the cost of reduced contributor convenience.