Oracle WebCenter Content EUVD-2026-37313

Requires (1) a reachable Oracle WebCenter Content 14.1.2.0.0 Content Server instance over HTTP/HTTPS, and (2) human interaction from a different user than the attacker (UI:R) - typically a currently authenticated WebCenter Content user, most impactfully an administrator or contributor, who must follow an attacker-supplied link or load attacker content in their browser. Exploitation is limited to this exact Fusion Middleware version (14.1.2.0.0), needs the victim to have an active authenticated session for the cross-scope impact to land on other Oracle products, and the attacker themselves is unauthenticated to WebCenter Content (PR:N) but does not need any pre-existing foothold.

Signals are mixed but lean toward high real-world risk: CVSS 3.1 is 9.3 with AV:N/AC:L/PR:N and a scope change (S:C) reflecting cross-product blast radius, which Oracle itself rated 'easily exploitable.' UI:R is the principal limiter - a logged-in user (likely a content author/administrator with active session) must be lured into clicking or visiting attacker content, which moves this away from worm-style mass exploitation toward phishing or watering-hole abuse against privileged operators. EPSS, KEV, and POC data are not provided in the input, so probability of in-the-wild use cannot be quantified; absence of a published CWE and any third-party reference beyond Oracle's CPU page also means independent technical corroboration is currently limited. The 'Authentication Bypass' tag conflicts mildly with UI:R (true bypasses usually don't need a victim), which should be verified against Oracle's advisory wording before treating it as an unauthenticated takeover.

An attacker emails a Content Server administrator a link to an attacker-controlled page; when the admin (already logged into WebCenter Content) visits it, the page issues a crafted HTTP request to the Content Server, which carries the victim's session and performs unauthorized reads or modifications of managed content and, due to scope change, of data in an integrated Oracle product. No public exploit is identified at time of analysis, but Oracle's own 'easily exploitable' rating suggests reliable weaponization is plausible once the advisory details are reverse-engineered.