EUVD-2026-37441Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable HTTP endpoint (AV:N), Oracle states easily exploitable (AC:L), requires a low-privileged WebCenter account (PR:L), no user interaction, and full takeover yields C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets a low-privileged remote attacker fully compromise the platform over HTTP without user interaction. Oracle's own CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability, and there is no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must hold a low-privileged authenticated account on the target Oracle WebCenter Content instance (PR:L in the CVSS vector) and must be able to reach the Content Server HTTP interface over the network; no user interaction, no special victim-side configuration, and no elevated role is required, and Oracle classifies the flaw as 'easily exploitable.' Limiting factors: the requirement for a valid low-privileged credential rules out fully unauthenticated internet scanning attacks, and instances where the Content Server HTTP endpoint is firewalled to internal networks or fronted by an authenticating reverse proxy with strict user provisioning are correspondingly harder to reach. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed but lean toward prioritized patching: the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a network-reachable, low-complexity flaw requiring only a low-privileged account and yielding full takeover, which is realistic for internet- or intranet-exposed WebCenter portals where any authenticated user role exists. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker obtains or registers a low-privileged WebCenter Content account (for example, a contributor or self-service portal user) and sends a crafted HTTP request to a vulnerable Content Server endpoint reachable on the network. Without any user interaction the request triggers the flaw and yields full takeover of the WebCenter Content instance - read/write access to all managed documents and the ability to disrupt service - which on an internet-exposed deployment is realistically reachable from anywhere. … |
| Remediation | Apply the Oracle Critical Patch Update of June 2026 for Fusion Middleware, which is the patch available per vendor advisory at https://www.oracle.com/security-alerts/cspujun2026.html - Oracle has not published a discrete fix-version string in the supplied data, so consult the CPU patch matrix for the exact bundle ID corresponding to your 12.2.1.4.0 or 14.1.2.0.0 deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all deployments of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 across production and non-production environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) allows a low-privilege
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged remote attacker over HT
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker sending HTTP req
Remote takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to fully
Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via the Content Server
Share
External POC / Exploit Code
Leaving vuln.today