EUVD-2026-37330Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed WebCenter Content Server
-
DeliverySend crafted HTTP request to Content Server endpoint
-
ExploitTrigger unauthenticated vulnerability
-
ExecutionObtain Content Server takeover
-
PersistExfiltrate or tamper with managed content
-
ImpactPivot into Fusion Middleware domain
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Content Content Server 12.2.1.4.0 and 14.1.2.0.0 over HTTP, with no user interaction and no privileges required (CVSS AV:N/AC:L/PR:N/UI:N). Limiting factors: the attacker must have network reach to the Content Server's HTTP/S listener, so deployments fronted by authenticated reverse proxies, VPN-only access, or IP allowlists materially reduce realistic exposure; only the two supported versions named by Oracle are confirmed affected, so installations on other patch levels need to be checked against the June 2026 CPU matrix. |
| Impact | All available signals point to high real-world risk: the CVSS vector is AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H, meaning network-reachable, low complexity, no privileges, no user interaction, and full compromise of confidentiality, integrity, and availability. Oracle's own language ('easily exploitable', 'takeover') reinforces the vector. EPSS and CISA KEV status were not supplied in the input, and no public proof-of-concept has been identified at time of analysis, so empirical exploitation likelihood cannot be independently quantified. The 'Information Disclosure' tag understates the impact relative to the vector's I:H/A:H - defenders should rely on the CVSS metrics and Oracle's takeover language rather than the tag. Treat any externally exposed Content Server as a priority remediation target; risk drops substantially for instances behind authenticated reverse proxies or VPNs. |
| Exploit ScenarioDerived | An attacker with only network reach to a WebCenter Content Server HTTP endpoint sends a crafted HTTP request that requires no authentication or user interaction and obtains full takeover of the Content Server, leading to disclosure of managed documents, modification or destruction of stored content, and use of the Content Server host as a foothold into the wider Fusion Middleware domain. The likely target profile is internet-exposed or extranet WebCenter portals used for document exchange with partners. No public exploit identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector implies a single-request exploitation primitive. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Unauthenticated remote takeover of Oracle WebCenter Content (Content Server component) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0 via a network-reachable HTTP attack path. The flaw carries a CVSS 9.8 with full confidentiality, integrity, and availability impact, and Oracle describes exploitation as 'easily exploitable.' No public exploit identified at time of analysis, but the combination of unauthenticated network reach and full compromise warrants prioritized patching of any internet-exposed Content Server.
RemediationAI
Apply the fixes delivered in Oracle's June 2026 Critical Patch Update for Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 as referenced at https://www.oracle.com/security-alerts/cspujun2026.html; exact bundle patch numbers are listed in the CPU matrix and should be selected per the running Fusion Middleware version. Oracle has not published a workaround in the advisory, so compensating controls until patching is complete should focus on reducing network exposure: terminate Content Server access at an authenticated reverse proxy or WAF, restrict ingress to the Content Server HTTP/S ports (typically 16200/16201 and the OHS/WebLogic fronting ports) to trusted management networks or VPN, and disable any unauthenticated public ingest endpoints - accepting that these controls will break federated content submission, anonymous portal browse, and some WebCenter Portal integrations. Monitor Content Server access logs for anomalous unauthenticated requests to /cs, /idcplg, and /_dav while the patch is rolling out.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Content is the enterprise content management (ECM) platform within Oracle Fusion Middleware, providing document management, records, digital asset, and imaging services. The vulnerable component is the Content Server, the core Java EE service that handles HTTP-based content ingest, search, and administrative operations and is typically fronted by Oracle HTTP Server / WebLogic. CPE data (cpe:2.3:a:oracle_corporation:oracle_webcenter_content) confirms the affected product family. No CWE was assigned by Oracle in the advisory, so the underlying weakness class (deserialization, authentication bypass, SSRF, etc.) is not disclosed - Oracle's Critical Patch Update process routinely omits CWE detail, which is consistent here.
Know when Oracle Webcenter Content gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes unauthenticated HTTP-reachable 'easy' exploitation leading to full Content Server takeover, justifying AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to unauthenticated remote complete system compromise, with no vendor patch currently available. Any internet-exposed Content Server instance provides attackers immediate and unrestricted access to all data and system controls. Organizations deploying these versions must immediately isolate affected systems from network access.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Network segmentation-block all external HTTP/HTTPS access to Content Server, restricting connections to internal trusted networks only; (2) Web application firewall-implement rate limiting, request filtering, and real-time alerting on suspicious patterns; (3) Access control hardening-disable unnecessary service accounts, enforce multi-factor authentication on administrative interfaces, and revoke unnecessary privileges; (4) Enhanced logging-enable full HTTP request auditing with centralized SIEM integration for immediate threat detection; (5) Business continuity-for non-critical Content Server instances, implement complete offline/air-gapped operation until patch availability is confirmed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Webcenter Content
View allAccount takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP networ
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker sending HTTP req
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged remote attacker over HT
Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) allows a low-privilege
Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via HTTP requests to t
Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via the Content Server
Remote takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to fully
Remote takeover of Oracle WebCenter Content 14.1.2.0.0 (Content Server component) is achievable by unauthenticated netwo
Account takeover in Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows a remote unauthenticated attac
Cross-scope compromise in Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows an unauthenticated remot
Cross-product compromise of Oracle WebCenter Content 14.1.2.0.0 (Fusion Middleware Content Server) allows a remote unaut
Cross-component compromise of Oracle WebCenter Content 14.1.2.0.0 (Content Server) allows a remote unauthenticated attac
GitHub PoC
Exploit-DB