Oracle WebCenter Content EUVD-2026-37415

No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Content 12.2.1.4.0 or 14.1.2.0.0 with the Content Server HTTP interface reachable by the attacker (CVSS AV:N/AC:L/PR:N/UI:N). The only practical limits are network reachability of the Content Server HTTP listener and the specific version being in the affected range; no user interaction, no authentication, and no non-default configuration are required per the vendor description.

Risk is high and concrete: CVSS 3.1 AV:N/AC:L/PR:N/UI:N gives remote, low-complexity, unauthenticated exploitation, and Oracle itself characterizes the flaw as 'easily exploitable' with takeover impact (C:H/I:H/A:H). No EPSS score, KEV listing, or public POC was supplied, so widespread mass-exploitation is not yet evidenced; however, Oracle WebCenter Content has a strong track record of post-CPU reverse-engineering, and similar 9.8 Fusion Middleware bugs (e.g., the WebLogic deserialization line) have been weaponized within weeks of CPU release. The data gap to call out: CWE is N/A, no SSVC decision was provided, and the only reference is Oracle's advisory page - defenders should not wait for KEV confirmation given the trivial exploitation profile.

An attacker on the internet identifies an Oracle WebCenter Content server (commonly fingerprinted via /cs/ or /idcplg URLs), sends a crafted HTTP request against the vulnerable Content Server component without supplying credentials, and gains takeover-level control of the application. From there the attacker can read or modify managed documents, pivot into the underlying Fusion Middleware/WebLogic host, and use stored credentials or trust relationships to move laterally; no public exploit is identified at time of analysis, but Oracle CPU bugs of this profile are typically reproduced quickly after disclosure.