Oracle WebCenter Content EUVD-2026-37449

Attacker must have network access to the Oracle WebCenter Content Server HTTP(S) interface and valid credentials for any low-privileged WebCenter Content account (CVSS PR:L), with no user interaction required (UI:N) and low attack complexity (AC:L) against the default configuration of supported versions 12.2.1.4.0 and 14.1.2.0.0. Exploitation is limited by the need for that authenticated session and by network exposure of the Content Server endpoint - deployments that keep WebCenter Content behind an internal network or VPN and that do not provision external low-privileged accounts materially reduce reachable attack surface, while environments that expose Content Server to partners, customers or large internal user populations should treat the precondition as effectively trivial.

The CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H and 9.9 base score are the strongest available signals: remote over HTTP, low complexity, only a low-privileged account required, no user interaction, scope change and full confidentiality/integrity/availability impact - Oracle itself labels it 'easily exploitable'. EPSS, KEV and SSVC data were not provided in the input, and no POC is referenced, so probability of widespread exploitation cannot be quantified; however, Oracle WebCenter Content has historically been a recurring target (prior CPU-driven CVEs have been added to CISA KEV), and the PR:L requirement is low friction in environments where any authenticated portal/content user account is reachable. Net assessment: this is a genuine high-priority issue rather than a CVSS-inflated edge case, with the main caveat that exploit availability and exact attack mechanics are not independently confirmed from the single Oracle advisory reference.

An attacker who has obtained or registered any low-privileged Oracle WebCenter Content account - for example via a self-service portal, a reused integration credential, or a phished employee - sends a crafted HTTP request to the Content Server endpoint and triggers the flaw without user interaction. Because the scope changes, the resulting code/data-access primitive lets them take over the WebCenter Content instance and pivot into integrated Fusion Middleware components (such as identity stores or downstream document consumers), exfiltrating sensitive content and planting backdoors; no public exploit identified at time of analysis, so initial waves are likely to be targeted rather than mass-scanned.