What is the CVSS score of EUVD-2026-37308?

EUVD-2026-37308 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle WebCenter Content EUVD-2026-37308

| CVE-2026-46790 MEDIUM

Information Exposure (CWE-200)

2026-06-16 oracle

Information Disclosure Oracle Oracle Webcenter Content Oracle Corporation

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated HTTP access with no complexity yields partial read-only impact; no integrity, availability, or scope change applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:27 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized information disclosure in Oracle WebCenter Content 14.1.2.0.0 exposes a subset of managed content to remote unauthenticated attackers via HTTP against the Content Server component. The intelligence tags classify the mechanism as an Authentication Bypass, suggesting the Content Server fails to enforce access controls on certain requests before serving content. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the zero-complexity, zero-privilege CVSS vector means any network-reachable attacker can attempt exploitation without preconditions.

Technical ContextAI

Oracle WebCenter Content is an enterprise content management platform within Oracle Fusion Middleware, responsible for document ingestion, metadata management, versioning, and role-based access control to stored content. The affected component is the Content Server, the HTTP-facing service through which clients retrieve and manage documents. The CPE string cpe:2.3:a:oracle_corporation:oracle_webcenter_content:*:*:*:*:*:*:*:* scopes this to version 14.1.2.0.0. No formal CWE is assigned by Oracle or NVD, but the intelligence tag 'Authentication Bypass' implies a failure in the access control layer - potentially a missing or incorrectly enforced authentication gate on specific Content Server endpoints. This class of flaw frequently arises from unprotected API routes, permissive URL pattern matching, or session validation gaps in Java EE-based middleware.

RemediationAI

Apply the patches released by Oracle under the June 2026 Critical Patch Update (CPU), referenced at https://www.oracle.com/security-alerts/cspujun2026.html, for Oracle WebCenter Content 14.1.2.0.0. Oracle CPUs are cumulative, so applying the current CPU constitutes the primary remediation. Until patching is complete, restrict network access to the Content Server HTTP interface to known trusted IP ranges using firewall ACLs or network segmentation - this directly limits the attack surface given the AV:N vector. Deploying a reverse proxy or web application firewall in front of the Content Server that enforces authentication before forwarding requests is an effective interim control, though it introduces a dependency on proxy configuration correctness. Review Content Server access logs for anomalous unauthenticated requests to content retrieval endpoints to identify potential exploitation attempts. No exact patched version number beyond the June 2026 CPU release was independently confirmed in the available data.