EUVD-2026-37442Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
HTTP-reachable Content Server (AV:N, AC:L), requires a low-privileged WebCenter account (PR:L), no user interaction, full takeover with documented cross-product scope change (S:C, C/I/A:H).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) allows a low-privileged remote attacker to compromise the application over HTTP and pivot to other products via a scope change. The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting easy exploitation with high confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must (1) reach the Oracle WebCenter Content Server over HTTP/HTTPS, and (2) hold a low-privileged authenticated account on the WebCenter Content instance (PR:L from the CVSS vector - typical contributor, self-service, or integration accounts qualify); no user interaction and no special non-default configuration are called out in Oracle's description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H is severe: network-reachable HTTP, low complexity, no user interaction, a scope change, and full CIA impact justify the 9.9 score, and 'low privileged' is a realistic prerequisite in WebCenter Content because the platform routinely issues self-service or contributor accounts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or registered any low-privileged WebCenter Content account sends crafted HTTP requests to the Content Server, abuses the flaw to escalate within the application, and takes full control of the WebCenter Content instance - then leverages the documented scope change to reach integrated Fusion Middleware components such as WebLogic-hosted services. Because UI:N and AC:L, the attack can be scripted against any exposed instance once the technique is known; no public exploit identified at time of analysis. |
| Remediation | Apply the patches shipped in the Oracle Critical Patch Update of June 2026 referenced at https://www.oracle.com/security-alerts/cspujun2026.html for Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0; the input does not name an exact post-patch build, so refer to the CPU advisory for the precise bundle/patch number for your platform. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WebCenter Content deployments running versions 12.2.1.4.0 or 14.1.2.0.0; review authentication logs for suspicious low-privileged account activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged remote attacker over HT
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker sending HTTP req
Remote takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to fully
Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via the Content Server
Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via HTTP requests to t
Share
External POC / Exploit Code
Leaving vuln.today