Oracle WebCenter Content EUVD-2026-46846

Exploitation requires network access to the Oracle WebCenter Content Server over HTTPS and targets supported versions 12.2.1.4.0 or 14.1.2.0.0; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed. The key limiting factor is high attack complexity (AC:H): Oracle rates this 'difficult to exploit,' implying the attacker must satisfy conditions beyond their direct control - such as specific server configuration, state, or timing - rather than firing a single unauthenticated request against a default install. The specific feature or configuration that must be present is not disclosed in Oracle's summary-level description, so the exact non-default prerequisite cannot be named from available data and should be confirmed against the July 2026 CPU advisory.

The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a high-impact, network-reachable, unauthenticated flaw whose severity is tempered by high attack complexity (AC:H), meaning successful exploitation likely requires specific conditions, timing, or non-trivial effort rather than a trivial single request. No EPSS score, SSVC decision, or POC was provided in the input, and the CVE is not in CISA KEV, so there is no evidence of active or automatable exploitation at this time. This is a credible priority for internet-exposed WebCenter Content deployments given the unauthenticated network vector and full-takeover impact, but the AC:H rating and absence of any exploitation signal suggest it is not (yet) a mass-exploitation threat; the 'Information Disclosure' tag conflicts with the full C/I/A/takeover language in the description - this discrepancy should be verified against the Oracle July 2026 CPU advisory before final triage.

An attacker who can reach an internet-exposed Oracle WebCenter Content Server over HTTPS sends specially crafted requests that, after meeting the flaw's non-trivial preconditions (high attack complexity), bypass authentication controls and gain full control of the Content Server. This yields takeover of the ECM repository, exposing and allowing modification or destruction of stored enterprise documents. No public proof-of-concept was identified at time of analysis.