Oracle WebCenter Content EUVD-2026-37452

Exploitation requires the attacker to already hold a high-privileged (administrative) account on the Oracle WebCenter Content Server, network reachability to its HTTP interface, and one of the affected Content Server versions (12.2.1.4.0 or 14.1.2.0.0) within Oracle Fusion Middleware; no end-user interaction is needed (UI:N) and attack complexity is low (AC:L). Real-world risk is therefore limited by how broadly Content Server admin privileges are granted in the environment and whether the management HTTP endpoints are reachable from untrusted networks - deployments that confine admin roles to a small group and place Content Server behind internal network segmentation are substantially harder to exploit even pre-patch.

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects easy network exploitation but only after obtaining high privileges, which materially constrains real-world exposure to insiders, compromised admin accounts, or chained attacks following an initial privilege escalation. There is no KEV listing, no EPSS score provided, no published POC, and no SSVC decision in the input, so exploitation is not known to be occurring in the wild; the risk profile is therefore 'serious if you have many admin accounts or the Content Server is exposed beyond the trust boundary' rather than a drop-everything internet-facing emergency. Two data gaps to verify: the absence of CWE makes the precise root cause uncertain, and Oracle's CPU does not enumerate per-bug technical detail, so defenders should treat the takeover claim as authoritative but the exploitation technique as undisclosed.

An attacker who already holds (or has compromised) a high-privileged Oracle WebCenter Content account - for example via phishing of an administrator, reuse of leaked SSO credentials, or chaining a prior privilege-escalation bug - reaches the Content Server over HTTP and invokes the vulnerable administrative function. Because AC:L and UI:N apply, the request can be scripted and requires no victim interaction, resulting in full takeover of the Content Server and its document repository. No public exploit identified at time of analysis, so any attack today would rely on attacker-developed tooling against the undisclosed code path.