Oracle WebCenter Content EUVD-2026-46859

Exploitation requires network reachability to the WebLogic T3 or IIOP protocol listeners serving WebCenter Content: Imaging and a low-privileged authenticated position (CVSS PR:L), with no user interaction and low attack complexity. The concrete prerequisite named in the description is access via the T3 or IIOP protocol to the affected 12.2.1.4.0 or 14.1.2.0.0 Imaging Core component. The principal limiting factor is that T3/IIOP are non-HTTP WebLogic protocols that in hardened deployments are firewalled to internal management segments; if these ports are not exposed to the attacker's network, exploitation is not possible. Some level of existing credentials/privilege is required, so this is not a fully unauthenticated internet drive-by.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with total impact to the Imaging system - a genuinely high-priority profile. Countervailing signals moderate the urgency: no EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no POC has been identified, so the current threat is potential rather than demonstrated. The most important real-world limiter is exposure: T3/IIOP should never be reachable from untrusted networks, so environments that restrict these protocols to internal/management segments face substantially lower practical risk than the raw 8.8 suggests, while internet-exposed WebLogic instances should treat this as critical. No key signals directly conflict, but the absence of EPSS/KEV data means exploitation likelihood is unquantified and should be revisited as Oracle CPU details and third-party analyses mature.

An attacker with a low-privilege foothold able to reach the WebLogic T3/IIOP listener (for example, a low-tier application account or an actor on an adjacent network segment) sends a crafted T3 or IIOP request to the Imaging service. Because attack complexity is low and no user interaction is needed, the request drives the Core component to a state that grants full control, resulting in takeover of WebCenter Content: Imaging. No public POC is currently identified, so this scenario is inferred from the CVSS vector rather than demonstrated exploit code.