EUVD-2026-37324Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Network-reachable Content Server, low complexity, no auth (PR:N), victim click required (UI:R), scope change into federated Fusion components, high confidentiality and partial integrity, no availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
AnalysisAI
Cross-context compromise of Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows a remote unauthenticated attacker over HTTPS to gain high-impact read access and limited write access to managed content, with effects that cross trust boundaries into additional Oracle Fusion Middleware products (scope change). Exploitation requires a victim to interact with attacker-controlled input (UI:R), and at the time of analysis there is no public exploit identified and the issue is not listed in CISA KEV.
Technical ContextAI
Oracle WebCenter Content is the enterprise content management platform inside Oracle Fusion Middleware, and the affected component - Content Server - is the core HTTP/HTTPS-facing service that stores, indexes, and renders managed documents and metadata. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_content scopes the flaw to that product family on version 14.1.2.0.0, and the CVSS scope change (S:C) indicates the vulnerable Content Server component can act on resources protected by a different security authority - typical of WebCenter deployments that federate with WebLogic, IDCS/IAM, or downstream Fusion apps. No CWE was published by Oracle, but the combination 'unauthenticated network attacker + UI:R + scope change + C:H/I:L' is characteristic of a client-side injection or response-splitting style flaw (for example reflected XSS or HTML/URL injection in a Content Server endpoint) that lets attacker-controlled markup execute in an authenticated user's session and reach federated resources; this should be treated as inference until Oracle publishes details.
RemediationAI
Apply the fixes from the Oracle Critical Patch Update of June 2026 referenced at https://www.oracle.com/security-alerts/cspujun2026.html - Oracle publishes per-product patch numbers in that bulletin and those are the authoritative versions to deploy on 14.1.2.0.0; no exact post-patch build is independently confirmed outside the CPU. Until the CPU is applied, restrict network access to the Content Server HTTPS endpoint to trusted networks or VPN only, place an authenticating reverse proxy (OHS/WAF) in front and enforce strict Content-Security-Policy, Referrer-Policy and X-Frame-Options to blunt the UI:R/scope-change vector, and advise WebCenter users not to follow untrusted links into Content Server - the trade-off is that proxy/WAF rules and CSP can break legitimate WebCenter portlet integrations and federated SSO flows, so test in a staging tenant first.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today