Oracle WebCenter Content EUVD-2026-46866

Exploitation requires network access to the WebCenter Content: Imaging Core component over HTTP plus a valid low-privileged account (CVSS PR:L), and no user interaction (UI:N) - so this is authenticated, not anonymous, exploitation. The affected deployment must be a supported build 12.2.1.4.0 or 14.1.2.0.0 with the Imaging module exposed to the attacker's network path. Limiting factors: the attacker must first hold or acquire application credentials, and reachability of the Imaging HTTP endpoint gates access; the Oracle advisory provides no specific non-default feature toggle as a prerequisite, indicating default supported configurations are exploitable by any authenticated low-privilege user.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) signals a genuinely high-priority, network-reachable flaw requiring only low privileges, no user interaction, and low attack complexity, with total compromise of the affected component. Counterbalancing signals lower the near-term urgency: there is no CISA KEV listing (not confirmed actively exploited), no public exploit identified, and no EPSS score or SSVC decision data provided in the input to gauge exploitation probability or automatability. The PR:L requirement means an attacker needs some valid low-level account, which limits purely anonymous internet-wide mass exploitation. Net assessment: treat as a real priority for patching given the low bar for an authenticated attacker and full-takeover impact, but absent KEV/POC/EPSS data this appears to be a patch-in-cycle risk rather than confirmed emergency in-the-wild exploitation - verify EPSS/exploit status before deprioritizing.

An attacker who holds or obtains a low-privileged WebCenter Content: Imaging account sends crafted HTTP requests to the Imaging Core web interface, abusing the flaw to escalate to full control of the Imaging application and its stored documents and workflows. Because attack complexity is low and no user interaction is needed, the request can likely be scripted and repeated; however, no public proof-of-concept has been identified at time of analysis.