Oracle WebCenter Content EUVD-2026-37308

No special conditions required beyond HTTP network access to an Oracle WebCenter Content 14.1.2.0.0 Content Server instance. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations with no attack complexity. The primary limiting factors are: (1) impact is bounded to read access on a subset of accessible content data only - no write, delete, or code execution capability is indicated; (2) scope is unchanged (S:U), preventing lateral pivot to other Fusion Middleware components through this vulnerability alone; and (3) exploitation is confined to version 14.1.2.0.0, so organizations on other versions are not confirmed affected. The specific Content Server endpoint or feature enabling the bypass is not disclosed in available data.

The CVSS 3.1 base score of 5.3 (Medium) is anchored by a confidentiality-only impact of C:L, meaning exploitation yields partial read access rather than full data compromise. However, the attack metrics are maximally favorable to an attacker - AV:N/AC:L/PR:N/UI:N - indicating no special positioning, no complexity, no credentials, and no victim interaction are required. No EPSS score was provided in the input data, so probability-of-exploitation cannot be quantified. KEV status is not confirmed, and no public POC has been identified, which moderates urgency. Despite the modest CVSS score, the unauthenticated network reachability on an enterprise content management system - which commonly stores sensitive business documents - elevates practical risk for organizations with internet-exposed deployments. The 'Authentication Bypass' tag, if accurate, suggests the flaw may be more structurally significant than the C:L rating implies, depending on what data resides in the accessible content subset.

An unauthenticated remote attacker with HTTP access to an Oracle WebCenter Content 14.1.2.0.0 deployment sends crafted requests to the Content Server, bypassing authentication checks to retrieve content documents or metadata they are not authorized to access. The low attack complexity means no prior reconnaissance or special tooling is required - standard HTTP clients suffice. No public exploit code has been identified at time of analysis, but the trivial attack conditions mean exploitation is achievable by any attacker who can reach the service.