Oracle WebCenter Content EUVD-2026-46861

Exploitation requires no attacker authentication (PR:N) and only network/HTTP reach to the WebCenter Content: Imaging application, but it is gated by two significant limiting factors drawn directly from Oracle's text: it is 'difficult to exploit' (CVSS AC:H), and it mandates human interaction from a person other than the attacker (UI:R) - a legitimate user must be induced to interact with the malicious content for the attack to succeed. There is no additional feature-flag or non-default configuration named in the advisory; the condition is the victim-interaction requirement plus network access to Imaging on affected versions 12.2.1.4.0 and 14.1.2.0.0. This is not zero-click: without a cooperating (tricked) human user and the specific conditions that make AC:H, the attack does not fire.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5) presents a genuine tension: it is unauthenticated and network-reachable with full triple-impact takeover, but High attack complexity plus required user interaction from a person other than the attacker materially lower real-world exploitability. No EPSS score was provided, the CVE is not in CISA KEV, and no POC is referenced, so all three exploitation-likelihood signals point to low near-term mass-exploitation risk - this reads as a serious-if-exploited but hard-to-trigger issue rather than a drop-everything emergency. No SSVC decision data was supplied. The most important caveat is that AC:H and UI:R are attacker-unfavorable conditions that will not be reflected in a naive 'CVSS 7.5, unauthenticated, network' triage, so teams should weight it below internet-facing zero-click flaws of the same score. Note also the source tag labels this 'Information Disclosure' while Oracle's own text says 'takeover' with I:H/A:H - the takeover framing should take precedence and the discrepancy verified against the Oracle CPU.

An attacker crafts a malicious HTTP request or link targeting the WebCenter Content: Imaging application and delivers it to a legitimate user (for example via email or a shared document reference). When that user, while interacting with the Imaging application, triggers the crafted content, the flaw executes in the victim's context and yields full takeover of the Imaging application. No public exploit code is identified at time of analysis, and the High attack complexity means reliable exploitation likely requires favorable timing or configuration.