EUVD-2026-37445Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed WebCenter Content host
-
DeliverySend crafted HTTP request to Content Server
-
ExploitTrigger unauthenticated takeover flaw
-
ExecutionGain Content Server control
-
ImpactExfiltrate managed documents and pivot
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against default configurations of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 Content Server, per Oracle's explicit 'easily exploitable' characterization and the AV:N/AC:L/PR:N/UI:N vector. The only practical limiting factors are network reachability of the Content Server HTTP port from the attacker and the target running one of the two named versions; deployments behind VPN/zero-trust ingress, or already patched to the June 2026 CPU level, are not exploitable. There is no user interaction, no authentication, and no non-default configuration requirement implied by Oracle's description. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H represents the worst practical combination: network-reachable, low-complexity, no auth, no user interaction, with full confidentiality, integrity, and availability impact - Oracle explicitly describes it as 'easily exploitable' resulting in 'takeover.' This CVE is not listed in CISA KEV and no public POC is referenced, and EPSS data was not provided, so real-world exploitation pressure is currently unknown despite the maximal CVSS. Oracle Fusion Middleware CPU bugs of this profile historically attract exploit development within weeks of disclosure (CVE-2023-22515, CVE-2021-35587 in WebLogic/Access Manager being recent comparators), so the gap between disclosure and weaponization should be treated as short. The tag 'Information Disclosure' in the input conflicts with Oracle's own 'takeover' wording and the C:H/I:H/A:H impact set - defenders should trust the CVSS vector over the tag. |
| Exploit ScenarioDerived | An external attacker scans for internet-exposed Oracle WebCenter Content instances on standard HTTP/HTTPS ports, sends a single crafted HTTP request to the vulnerable Content Server endpoint, and gains full control of the application - enabling theft of managed documents, modification of records, and use of the server as a pivot into the Fusion Middleware tier. No credentials, user interaction, or prior foothold are required, and given Oracle's 'easily exploitable' wording, mass scanning is plausible once a POC emerges even though none is publicly identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via the Content Server component over HTTP, scored CVSS 9.8 by Oracle. No public exploit identified at time of analysis, but the low attack complexity and lack of authentication requirement make this a high-priority patch target for any Oracle Fusion Middleware environment exposing WebCenter Content.
RemediationAI
Apply the Oracle Critical Patch Update for June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html, which is the patch available per vendor advisory for both 12.2.1.4.0 and 14.1.2.0.0 - Oracle CPU patches are cumulative, so install the full CPU bundle rather than only the WebCenter component fix. Until the CPU is deployed, restrict HTTP access to the Content Server to known administrative networks via firewall or reverse-proxy ACLs, place the deployment behind a WAF with rules blocking anomalous Content Server URIs (recognizing WAF rules cannot reliably block an unspecified flaw and may break legitimate ingest workflows), and disable any internet-facing exposure of the Content Server admin endpoints. Increase logging on the Content Server HTTP layer and monitor for unauthenticated POST traffic to non-public endpoints; note that network restriction will impact remote contributors and integrations that rely on direct Content Server connectivity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Content is the enterprise content management platform within Oracle Fusion Middleware, used for document management, records management, and digital asset management. The vulnerable component is the Content Server, which exposes HTTP-based services for content ingest, retrieval, and administration. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_content covers both affected releases. No CWE was assigned by Oracle, which is typical of Oracle CPU disclosures that withhold root-cause class to limit reverse-engineering; given the unauthenticated network vector with full CIA impact, the underlying flaw is most likely an authentication bypass, deserialization, or injection issue in an HTTP-exposed Content Server endpoint, but the specific class cannot be confirmed from the available data.
Know when Oracle Webcenter Content gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle states unauthenticated network HTTP exploitation is easy and results in full product takeover, justifying AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H and unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to unauthenticated remote system takeover via the Content Server component, with a critical CVSS 9.8 score. Any organization running these versions-particularly those exposing WebCenter Content over untrusted networks-faces immediate risk of complete infrastructure compromise. With no vendor patch currently available, rapid containment actions are essential to prevent unauthorized access to sensitive content and systems.
Until vendor patch is released: (1) Implement network segmentation-restrict WebCenter Content access to authenticated internal networks only via firewall rules; (2) Deploy Web Application Firewall (WAF) or IPS rules blocking exploit patterns targeting the Content Server component; (3) Enable comprehensive logging and alerting on all administrative and remote connections to WebCenter Content; (4) Consider taking the service offline temporarily if business function allows; (5) Coordinate with Oracle for expedited patch delivery given CVSS 9.8 severity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Webcenter Content
View allAccount takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP networ
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker sending HTTP req
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged remote attacker over HT
Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) allows a low-privilege
Unauthenticated remote takeover of Oracle WebCenter Content (Content Server component) is possible in supported versions
Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via HTTP requests to t
Remote takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to fully
Remote takeover of Oracle WebCenter Content 14.1.2.0.0 (Content Server component) is achievable by unauthenticated netwo
Account takeover in Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows a remote unauthenticated attac
Cross-scope compromise in Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows an unauthenticated remot
Cross-product compromise of Oracle WebCenter Content 14.1.2.0.0 (Fusion Middleware Content Server) allows a remote unaut
Cross-component compromise of Oracle WebCenter Content 14.1.2.0.0 (Content Server) allows a remote unauthenticated attac
GitHub PoC
Exploit-DB