Oracle WebCenter Content EUVD-2026-37401

Attacker must (1) hold a high-privileged Oracle WebCenter Content account (PR:H - administrator-equivalent role on the Content Server), (2) have HTTP/HTTPS network reachability to the Content Server instance, and (3) be targeting a supported version 12.2.1.4.0 or 14.1.2.0.0 prior to the June 2026 CPU. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the PR:H requirement means the bug is not exploitable by anonymous or low-privileged users, so realistic exposure depends on how broadly Content Server admin credentials are issued and whether the admin HTTP interface is reachable from untrusted networks.

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H yields 9.1 because the scope change and full CIA impact outweigh the PR:H requirement - meaning a legitimate high-privileged Content Server account (an administrator or equivalent role) can compromise both WebCenter Content and adjacent products. EPSS and SSVC values were not provided in the input, and the CVE is not on the CISA KEV list, so there is no signal of active exploitation. No POC is referenced. Realistic risk is therefore high in environments where WebCenter Content administrator credentials are reachable from networks an attacker can already touch (insider threat, credential theft, or chained compromise from a lower-privileged Fusion Middleware bug), but lower for hardened deployments where admin access is tightly segmented. PR:H plus the absence of public exploitation suggests this is a serious patch-this-quarter item rather than an emergency drop-everything fix.

An attacker who has obtained a WebCenter Content administrator credential - through phishing, password reuse, or chaining from a separate Fusion Middleware vulnerability - authenticates to the Content Server over HTTP from anywhere on the network and invokes the vulnerable privileged function to take full control of WebCenter Content. Because the issue is scope-changing, the same action also lets them reach and tamper with adjacent products such as the underlying WebLogic domain or integrated repositories. No public exploit is identified at time of analysis, so an attacker would currently need to develop the technique from the Oracle advisory and binary diffing of the CPU.