Oracle WebCenter Content EUVD-2026-46863

Exploitation requires network HTTP access to the WebCenter Content: Imaging application, a valid low-privileged account (PR:L - not a pure unauthenticated bypass despite the 'Authentication Bypass' tag), and human interaction from a different, higher-context user (UI:R) who must be induced to perform an action for the attack to succeed. It applies to Fusion Middleware WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0 specifically. The limiting factors are the required authenticated foothold and the mandatory victim interaction, which prevent silent, fully automated exploitation; the scope change (S:C) is what allows impact to extend beyond Imaging once those conditions are met.

Signals partially align: the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, base 8.7) indicates a network-reachable, low-complexity attack needing only low privileges but also requiring human interaction from a victim other than the attacker, which meaningfully lowers the practical exploitability versus a fully unauthenticated, no-interaction bug. The scope change and dual High confidentiality/integrity impact drive the high base score, while Availability is unaffected (A:N). No EPSS score was supplied, no SSVC decision was provided, the CVE is not in CISA KEV, and no POC or exploit code is referenced - so real-world exploitation pressure appears low-to-moderate today and this reads as a genuine-but-not-emergency priority. Note a conflict worth flagging: the vendor tag says 'Authentication Bypass' yet the vector requires PR:L (a low-privileged account) and UI:R (victim interaction), so it is not a pure pre-auth bypass - verify the precise privilege prerequisite with Oracle before treating it as unauthenticated.

An attacker holding a low-privileged WebCenter Content: Imaging account crafts a malicious HTTP request or link and induces a higher-context authenticated user to trigger it (for example by opening a link or performing an in-app action), causing the operation to execute across the intended authorization boundary. Because the scope changes, the attacker can then read, alter, or delete critical Imaging-managed documents and potentially affect connected products. No public exploit code is identified at time of analysis, so exploitation would currently require custom development.