Oracle WebCenter Content EUVD-2026-46749

Exploitation requires network access to the Oracle WebCenter Content Server over HTTP and low-privileged authenticated access (CVSS PR:L), so the attacker must possess or obtain a valid low-privilege account or session on the application - it is not fully unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Affected deployments are limited to supported versions 12.2.1.4.0 and 14.1.2.0.0; other versions are outside this advisory's stated scope. The primary limiting factor is the authentication requirement, which is meaningful for hardened internal deployments but a low barrier for internet-facing instances or environments with broad user provisioning. The specific vulnerable feature/endpoint within Content Server is not disclosed by Oracle.

Signals are broadly consistent and point to a genuine priority for organizations running the affected versions. The CVSS vector AV:N/AC:L/PR:L/UI:N (8.8) shows a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with scope unchanged but full high impact to confidentiality, integrity, and availability - Oracle explicitly labels it 'easily exploitable' and describes a full 'takeover.' Countervailing signals: it is not in CISA KEV and no POC or exploit code is identified at time of analysis, and no EPSS score was provided in the input, so real-world exploitation probability cannot be quantified from the available data. The PR:L requirement is the main limiting factor - an attacker needs at least a low-privileged account or valid session - but on internet-facing or broadly-accessible internal deployments this is a low bar, so treat this as high priority for patching despite the absence of confirmed active exploitation.

An attacker who holds or phishes a low-privileged Content Server account (or obtains a valid session) sends crafted HTTP requests to the network-exposed WebCenter Content application and abuses the flaw to escalate to full control, reading and altering managed documents and taking over the service. No user interaction is required and attack complexity is low, so a single authenticated request path could suffice; no public POC is identified at time of analysis.