Oracle WebCenter Content EUVD-2026-46860

Exploitation requires the attacker to already possess high privileges within Oracle WebCenter Content: Imaging (CVSS PR:H) and network HTTP access to the Imaging Core component; there is no user-interaction requirement (UI:N) and attack complexity is low (AC:L). The limiting factor is the privilege prerequisite - an anonymous or low-privileged user cannot exploit this, so realistic risk is confined to trusted administrators, compromised privileged accounts, or an attacker who has already escalated to admin level. Only supported versions 12.2.1.4.0 and 14.1.2.0.0 are stated as affected; deployments must expose the Imaging HTTP interface to the attacker's network position.

The CVSS 3.1 base score is 7.2 (High), driven by network attack vector, low complexity, no user interaction, and full C/I/A impact, but critically gated by PR:H - exploitation requires the attacker to already hold high privileges within the application. This significantly narrows the realistic threat to insiders, compromised privileged accounts, or attackers who have already gained an administrative foothold, rather than anonymous internet-based actors. No EPSS score, SSVC decision, KEV listing, or POC was provided, so probabilistic exploitation signals are absent; the absence of KEV plus the PR:H requirement suggests this is a defense-in-depth/privilege-escalation-to-takeover concern rather than a mass-exploitation emergency. Note a mild tension in the source data: Oracle tags the issue as 'Information Disclosure,' yet the CVSS vector rates Integrity and Availability as High and describes full 'takeover,' so the tag appears to understate the actual impact - treat the CVSS-described takeover as authoritative and verify scope with Oracle.

An attacker who has obtained a high-privilege WebCenter Content: Imaging account - for example a rogue administrator, or an outsider who phished or brute-forced privileged credentials - sends crafted HTTP requests to the Imaging Core component to abuse the flaw and escalate to full control of the application. Because attack complexity is low and no user interaction is needed, a single authenticated session is sufficient to read, alter, or destroy imaged documents and take over the service. No public proof-of-concept exploit code has been identified at time of analysis.