Oracle WebCenter Content EUVD-2026-37453

Attacker must hold valid low-privileged credentials on the Oracle WebCenter Content Content Server (PR:L) and reach it over HTTPS, and a different user - not the attacker - must interact with the malicious content for the exploit to fire (UI:R). Limiting factors: only WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 deployments are vulnerable; instances that do not allow untrusted users to author or submit content are effectively out of reach; and the scope-changed impact requires that the victim's session has access to the downstream Fusion Middleware resources the attacker wants to reach.

CVSS 3.1 rates this 7.6 (High), driven by network reach, low complexity, low privileges, and a scope change that elevates the blast radius beyond the vulnerable component. However, UI:R (a human other than the attacker must act) and PR:L (the attacker must hold valid credentials) materially limit mass exploitation, which is consistent with no EPSS data provided and no KEV entry. There is no POC referenced, so prioritization should be driven by exposure of WebCenter Content portals to authenticated but untrusted users (contractors, partners, large user bases) rather than treating this as a wormable internet-facing bug. Key uncertainty: the 'Authentication Bypass' tag conflicts with the PR:L requirement in the CVSS vector - vendor wording should be re-checked, as the tag may be inaccurate or refer to downstream impact in the scope-changed system.

A low-privileged WebCenter Content user (for example, a contributor account on a partner portal) uploads or submits crafted content into the Content Server that, when later opened by an administrator or other higher-privileged user through the normal UI, executes in that victim's authenticated context and exfiltrates sensitive documents or pivots into linked Fusion Middleware components. No public exploit code has been identified at time of analysis, but the low attack complexity and standard HTTPS vector make weaponization straightforward once an internal triage is published.