EUVD-2026-37455Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed WebCenter Content portal
-
DeliverySend crafted HTTP request to Content Server
-
ExploitTrigger unauthenticated flaw
-
ExecutionGain code execution or admin control
-
ImpactExfiltrate documents and pivot internally
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Content 12.2.1.4.0 or 14.1.2.0.0 over HTTP to the Content Server component, per CVSS AV:N/AC:L/PR:N/UI:N. Limiting factors: the target must be running one of the two enumerated affected versions, the attacker must have network reachability to the Content Server HTTP listener (often internal-only in mature deployments), and the deployment must not yet have applied the June 2026 CPU patch. No user interaction, authentication, or non-default configuration is required. |
| Impact | All available signals point to high real-world risk: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H means a remote, unauthenticated attacker can fully compromise the system over HTTP with low attack complexity and no user interaction. Oracle itself classifies the flaw as 'easily exploitable' with 'takeover' impact, reinforcing the raw CVSS picture. EPSS, KEV, and SSVC data are not provided in the input, and no POC is referenced, so probabilistic exploitation likelihood cannot be quantified - however, Oracle WebCenter Content deployments are typically internet-exposed enterprise portals, and historical Fusion Middleware bugs of this profile (e.g., the WebLogic deserialization series) have been weaponized rapidly after CPU disclosure. The tag 'Information Disclosure' is narrower than the C:H/I:H/A:H impact claimed in the description and Oracle's takeover language - treat the description as authoritative and the tag as incomplete metadata. |
| Exploit ScenarioDerived | An attacker scans the internet for Oracle WebCenter Content portals (commonly identifiable by /cs/ URI patterns or Oracle branding), then sends a single crafted HTTP request to a vulnerable Content Server endpoint on 12.2.1.4.0 or 14.1.2.0.0. The request triggers the flaw without any login, yielding full takeover - code execution or equivalent administrative control over the document repository, its contents, and any credentials cached on the host. No public POC is referenced yet, but the AC:L/PR:N profile means functional exploits are likely to emerge quickly post-CPU. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via HTTP requests to the Content Server component, per Oracle's June 2026 CPU advisory. The CVSS 9.8 score reflects full confidentiality, integrity, and availability impact with no authentication required. Status is no public exploit identified at time of analysis, but trivial exploitability against an internet-facing enterprise content platform makes this a priority patching candidate.
RemediationAI
Apply the patches delivered in Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) for Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 - Patch available per vendor advisory, with the exact post-patch build identifiers documented in the CPU notes per version line. Until patching, restrict network reachability of the Content Server HTTP/HTTPS listener to trusted management networks via firewall or reverse-proxy ACLs, and place any internet-facing instance behind a WAF with rules blocking anomalous request paths to /cs/ and other Content Server endpoints; both controls will block legitimate end-user document access from outside the trusted zone, so coordinate with content-consuming applications. Increase HTTP access logging on the Content Server tier and alert on unusual POSTs or large response bodies to administrative URIs as a detective compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Content is the enterprise content management platform within Oracle Fusion Middleware, used to store, version, and serve documents and digital assets across large organizations. The flaw resides in the Content Server component, which exposes HTTP endpoints for document ingest, retrieval, and administrative workflows. The CWE is not assigned, but the combination of network attack vector, no privileges required, and full triad impact is characteristic of an unauthenticated request-handling defect - typically deserialization, path traversal-to-RCE, or authentication bypass - in a Java EE servlet endpoint. CPE coverage (cpe:2.3:a:oracle_corporation:oracle_webcenter_content) confirms the Oracle Corporation product family is the sole affected codebase.
Know when Oracle Webcenter Content gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle states easily exploitable over HTTP by an unauthenticated attacker resulting in product takeover, justifying AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H with no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to complete remote system compromise without authentication, exposing sensitive enterprise content and operational control. Any organization deploying these versions in internet-accessible or network-reachable environments faces immediate risk of data exfiltration, system takeover, and regulatory breach. Leadership must prioritize rapid containment and remediation planning to prevent breach and operational loss.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to Content Server via firewall rules or network segmentation; require authenticated VPN for any administrative or user access; deploy web application firewall with signature rules to detect exploitation attempts against HTTP endpoints; implement 24/7 monitoring and alerting for Content Server access anomalies; consider disabling internet-facing access until patched version is available; increase audit logging retention on affected systems for breach investigation if compromise occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Webcenter Content
View allAccount takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP networ
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker sending HTTP req
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged remote attacker over HT
Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) allows a low-privilege
Unauthenticated remote takeover of Oracle WebCenter Content (Content Server component) is possible in supported versions
Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via the Content Server
Remote takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to fully
Remote takeover of Oracle WebCenter Content 14.1.2.0.0 (Content Server component) is achievable by unauthenticated netwo
Account takeover in Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows a remote unauthenticated attac
Cross-scope compromise in Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows an unauthenticated remot
Cross-product compromise of Oracle WebCenter Content 14.1.2.0.0 (Fusion Middleware Content Server) allows a remote unaut
Cross-component compromise of Oracle WebCenter Content 14.1.2.0.0 (Content Server) allows a remote unauthenticated attac
GitHub PoC
Exploit-DB