Oracle WebCenter Content EUVD-2026-46840

Exploitation requires network access to the Oracle WebCenter Content HTTP interface and a valid low-privileged account (CVSS PR:L), so this is authenticated rather than unauthenticated access; no user interaction is needed (UI:N) and attack complexity is low (AC:L), matching Oracle's 'easily exploitable' wording. The affected deployments are the supported 12.2.1.4.0 and 14.1.2.0.0 Content Server release lines. The key limiting factors defenders can rely on are: the attacker must already possess or obtain low-level credentials, and the Content Server HTTP endpoint must be reachable from the attacker's position - restricting either substantially reduces realistic exploitability. The scope change (S:C) means impact is not confined to WebCenter Content and may reach adjacent products.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) describes an easily exploitable, network-reachable flaw needing only low privileges and no user interaction, with high confidentiality impact, low integrity impact, and a scope change - Oracle explicitly labels it 'easily exploitable,' which is a meaningful priority signal for an internet- or intranet-exposed ECM system. No EPSS score, POC, or KEV status was provided in the input, so probabilistic exploitation likelihood and confirmed real-world use are both UNKNOWN and cannot be asserted. The requirement for an existing low-privileged account (PR:L) is the main limiting factor: this is not an unauthenticated remote takeover, so realistic risk is highest where many users or federated/less-trusted accounts can reach the Content Server. The scope change and 'significantly impact additional products' language elevate blast radius beyond a single app, but no SSVC decision data was supplied, so automatability and technical-impact-under-SSVC are not independently confirmed. Net: a genuine high-priority patch item for anyone running WebCenter Content, tempered by the fact that active exploitation is not evidenced in the provided data.

An attacker who holds or phishes a low-privileged WebCenter Content account sends crafted HTTP requests to the Content Server and, by abusing the access-control/authentication-bypass weakness, reads confidential documents and metadata across the repository and alters a subset of stored data. Because the flaw carries a scope change, the same access can be leveraged to affect additional connected products. No public exploit code was identified at time of analysis, so this scenario is inferred from the CVSS vector and vendor description rather than a demonstrated POC.