What is the CVSS score of EUVD-2026-37326?

EUVD-2026-37326 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by EUVD-2026-37326?

Oracle WebCenter Content 14.1.2.0.0 contains a critical vulnerability enabling attackers with low-privileged access to read and modify sensitive data across interconnected Oracle Fusion Middleware…

How to fix or mitigate EUVD-2026-37326?

Within 24 hours: Identify and document all systems running Oracle WebCenter Content 14.1.2.0.0; assess exposure of low-privileged user accounts and user interaction dependencies. Within 7 days: Implement network segmentation isolating WebCenter Content from sensitive systems, enforce strict least-privilege access controls, and enable enhanced logging for data access and cross-product authentication attempts. Within 30 days: Monitor Oracle security advisories and CISA bulletins daily for patch availability; develop and initiate execution of a remediation plan including planned version upgrades or system migration timelines.

Oracle WebCenter Content EUVD-2026-37326

| CVE-2026-46808 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

8.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

HTTP-reachable Content Server (AV:N/AC:L), requires a low-privileged account (PR:L) and a second user's interaction (UI:R); scope change to other Fusion Middleware with full C/I impact, no availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:52 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

AnalysisAI

Cross-product compromise in Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows a low-privileged remote attacker to read and modify critical data with scope change to additional Oracle Fusion Middleware products. Exploitation requires user interaction from a separate victim and yields high confidentiality and integrity impact (CVSS 3.1 base 8.7); no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management platform within Oracle Fusion Middleware, providing document, records, and digital asset management through the Content Server component over HTTP(S). The affected build 14.1.2.0.0 is the current 14c release line, identified by CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_content:*. No CWE was assigned, but the tag 'Authentication Bypass' combined with a scope-change vector (S:C) and required user interaction suggests a flaw where an authenticated low-privileged user can craft content or links that, once rendered or actioned by another user/service, cross trust boundaries - consistent with stored XSS, CSRF-style trust abuse, or token/session reuse against integrated Fusion Middleware components rather than a memory-corruption bug.

RemediationAI

Apply the fixes shipped in the Oracle Critical Patch Update June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) for Oracle WebCenter Content 14.1.2.0.0 - patch available per vendor advisory; no standalone fix version is published outside the CPU bundle. Until the CPU is applied, restrict HTTP access to the Content Server to trusted networks or VPN, tighten account provisioning so that low-privileged WebCenter accounts cannot be created freely or by self-service, and consider disabling or sandboxing content-preview/rendering features that could deliver attacker-crafted payloads to a second user (trade-off: end users lose inline preview and may resort to downloading content). Enable WAF rules to inspect uploaded content and outbound responses for script payloads, and audit recently created or modified items by low-privileged accounts; note that monitoring alone does not block the scope-change impact on downstream Fusion Middleware components.