Oracle WebCenter Content EUVD-2026-37443

Attacker must be able to reach the Content Server HTTP interface of an Oracle WebCenter Content 12.2.1.4.0 or 14.1.2.0.0 deployment and must hold valid credentials for any low-privileged WebCenter Content account (PR:L) - anonymous internet exploitation is not in scope per the CVSS vector. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once credentials and HTTP reachability are present, no special configuration toggle is needed beyond running a supported, unpatched version of the Content Server component. Limiting factors: the Content Server must be network-reachable from the attacker (deployments restricted to internal management VLANs significantly reduce exposure), and the attacker needs at least one working low-privileged account, so environments with strong identity hygiene and segmented WebCenter access face materially lower realistic risk.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H produces 8.8 (High), with every attack-difficulty metric pointing toward easy exploitation: reachable over the network, low complexity, no user interaction, and only a low-privileged account required. Oracle explicitly describes successful attacks as resulting in full 'takeover' of WebCenter Content, which aligns with C:H/I:H/A:H. There is no EPSS score, KEV listing or public POC supplied in the intelligence set, so likelihood signals are limited - the score reflects ease and impact rather than observed exploitation. The realistic risk is meaningful because WebCenter Content typically holds sensitive corporate documents and contracts, and low-privileged accounts are often broadly provisioned in enterprise CMS deployments; absence of KEV/EPSS data should not be read as low risk, only as 'not yet observed in published telemetry'.

An attacker who already holds (or has phished/compromised) any low-privileged WebCenter Content account - for example a standard contributor user - connects to the Content Server over HTTP and issues a crafted request that abuses the vulnerable handler to escalate to full administrative control of the content repository. With takeover achieved, the attacker exfiltrates confidential documents, plants or modifies records, and disables availability of the CMS for legitimate users. No public exploit identified at time of analysis, but the AC:L / PR:L / UI:N profile means weaponization would be straightforward once the underlying bug is known.