What is the CVSS score of EUVD-2026-37446?

EUVD-2026-37446 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Content are affected by EUVD-2026-37446?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to unauthenticated remote takeover through the Content Server component, enabling attackers to achieve complete system…

How to fix or mitigate EUVD-2026-37446?

Within 24 hours: Restrict network access to Oracle WebCenter Content instances running versions 12.2.1.4.0 or 14.1.2.0.0; deploy Web Application Firewall (WAF) rules targeting Content Server endpoints. Within 7 days: Implement network segmentation to isolate Content Server from other Oracle Fusion Middleware components; enable comprehensive audit logging on all Content Server activities; inventory all downstream systems with dependencies. Within 30 days: Upgrade to patched versions when released by Oracle; if upgrade is not feasible within 30 days, decommission or air-gap affected systems; conduct forensic analysis for evidence of compromise.

Oracle WebCenter Content EUVD-2026-37446

| CVE-2026-35320 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

9.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Network HTTP reach with no auth or user interaction (AV:N/PR:N/UI:N), Oracle-stated difficult conditions (AC:H), scope change to adjacent Fusion Middleware (S:C), and stated full takeover (C:H/I:H/A:H).

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:16 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible through the Content Server component, allowing an unauthenticated network attacker to fully compromise the product with cascading impact to other Oracle Fusion Middleware components due to a scope change. Oracle assigned a CVSS 3.1 base score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), and no public exploit identified at time of analysis. The high attack complexity tempers the otherwise critical rating, but a successful exploit yields complete takeover.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management (ECM) platform within Oracle Fusion Middleware, used for managing documents, records, digital assets, and web content; the affected Content Server is the core repository service that exposes HTTP-based interfaces for ingestion, retrieval, and administration. The CPE 'cpe:2.3:a:oracle_corporation:oracle_webcenter_content' confirms the application-layer scope, and the scope-change flag (S:C) in the CVSS vector indicates the vulnerable Content Server can pivot privileges into adjacent Fusion Middleware components (e.g., WebLogic, Oracle Database connections, identity stores). No CWE was assigned by Oracle, which is typical for CPU advisories; the description's emphasis on full takeover plus scope change is consistent with a deserialization, authentication bypass, or server-side request/template injection class flaw in the HTTP-handling layer, though Oracle does not publicly disclose technical specifics.

RemediationAI

Apply the Oracle Critical Patch Update of June 2026 (cspujun2026) referenced at https://www.oracle.com/security-alerts/cspujun2026.html to the affected 12.2.1.4.0 and 14.1.2.0.0 WebCenter Content deployments - Oracle CPU advisories bundle the exact patch numbers per platform that should be applied through OPatch following the standard Fusion Middleware patching procedure. Until patching is complete, restrict network reachability to the Content Server HTTP and HTTPS listeners via firewall ACLs or reverse-proxy allowlists so only trusted intranet ranges can reach the service (trade-off: breaks federated or partner access to documents), and consider placing a WAF in front of the Content Server with rules to block anomalous administrative or RIDC-style requests (trade-off: signature gaps until Oracle releases technical detail). Because S:C indicates lateral impact, also audit downstream WebLogic, identity, and database credentials that Content Server uses, and rotate them after patching if the system was internet-exposed.