Oracle WebCenter Content EUVD-2026-46879

Exploitation requires network reachability to the WebLogic T3 or IIOP protocol listeners fronting WebCenter Content: Imaging, and the attacker must already hold high privileges (CVSS PR:H) - this is not an unauthenticated attack. It applies specifically to Fusion Middleware WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0. Limiting factors: the required high privilege level, and the need for exposed/accessible T3 or IIOP ports - deployments that firewall or disable these proprietary WebLogic protocols, or that do not expose them beyond trusted admin hosts, substantially reduce reachability. No user interaction is required (UI:N) and complexity is low (AC:L).

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High) shows network-reachable, low-complexity exploitation but explicitly requires high privileges (PR:H), which is the dominant limiting factor - an attacker must already hold elevated/authenticated access to the T3/IIOP interface. No EPSS score, KEV entry, POC, or SSVC decision data is provided, so exploitation likelihood cannot be quantified from the input; the absence of KEV and public exploit tempers real-world urgency. This is a genuine high-severity issue for the affected component, but the PR:H requirement means it is more relevant as a privilege-escalation/lateral-movement risk from an already-authenticated foothold than as a mass-exploitable internet threat. Note the tension worth verifying: the vector is C:H/I:H/A:H (full takeover) while the only source tag is 'Information Disclosure' - the takeover language should be treated as authoritative over the tag.

An attacker who has obtained high-privileged credentials or an authenticated foothold on the network sends crafted requests to the WebLogic T3 or IIOP listener serving WebCenter Content: Imaging. Leveraging the low attack complexity, they manipulate the Core component to gain full control of the Imaging application, reading and altering stored documents and disrupting service. No public POC is referenced in the available data.