Oracle WebCenter Content EUVD-2026-37448

Attacker must have network HTTP/HTTPS reachability to the Oracle WebCenter Content Server component and valid credentials for any low-privileged WebCenter account (PR:L) - typically any authenticated user role on the Content Server, including contributor or consumer tiers commonly granted to broad employee populations via SSO. No user interaction (UI:N) and no elevated role are required, and exploitation works against default configurations of versions 12.2.1.4.0 and 14.1.2.0.0. Exploitation is limited by the need for a working WebCenter account on the target instance and by network reachability to the Content Server HTTP listener; deployments that fully isolate Content Server behind administrative VPNs or that scope user accounts to read-only federated identities materially raise the bar.

This is a genuine priority for any Internet- or intranet-exposed WebCenter Content deployment. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N with S:U and C:H/I:H/A:H, combined with Oracle's own 'easily exploitable' wording and 'takeover' outcome, means any user with a valid low-privilege account (a population that in WebCenter typically includes many business users and integrations) can fully compromise the server. EPSS, KEV status, and POC availability were not provided in the input - so there is no public exploit identified at time of analysis, but absence of a public PoC is weak comfort given Oracle CPU advisories are routinely reverse-engineered by exploit researchers within weeks. The main mitigating factor versus a PR:N RCE is the authentication requirement; the main aggravating factor is that WebCenter Content is frequently integrated with single sign-on and broad user populations, so PR:L is a low bar in practice.

An attacker obtains or phishes a low-privileged WebCenter Content user account - for example a contributor or reader role provisioned via SSO - and sends a single crafted HTTP request to the Content Server's IdcCommand or RIDC endpoint over the corporate network. Because attack complexity is low and no user interaction is required, the request directly triggers the flaw and yields full takeover of the Content Server, exposing all stored documents and allowing arbitrary modification or destruction. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' language strongly suggests a reliable single-request primitive.