Oracle WebCenter Content EUVD-2026-46887

Exploitation requires network reachability to the Oracle WebCenter Content Server over HTTP and a valid low-privileged authenticated session (CVSS PR:L, so the attacker must already be able to log in at a basic level - not fully anonymous). Limiting factors: the CVSS vector marks the attack complexity as High (AC:H), meaning success depends on conditions outside the attacker's control such as specific timing, state, or configuration, which reduces reliability; only supported versions 12.2.1.4.0 and 14.1.2.0.0 are named as affected; and no user interaction is needed (UI:N). The 'Authentication Bypass' tag hints some access-control step can be circumvented, but Oracle's advisory does not specify the exact feature or setting, so the precise trigger condition is not confirmed from available data.

Signals are mixed and lean toward a real but not top-tier priority. The CVSS 3.1 base score is 8.2 (High) driven by high confidentiality and integrity impact plus a scope change, but two metrics temper real-world urgency: AC:H (difficult to exploit, implying non-trivial preconditions or timing) and PR:L (attacker must already hold low-level authenticated access). There is no KEV listing (not confirmed actively exploited), no public POC (no public exploit identified at time of analysis), and no EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified from the input. SSVC-style reasoning: exploitation status appears to be 'none', automatable is likely 'no' given AC:H and required authentication, and technical impact is 'total' for WebCenter-accessible data. Net: patch on a normal-to-expedited enterprise cycle rather than emergency, weighted up if the affected servers are internet-exposed or hold sensitive content. Note the 'Authentication Bypass' tag conflicts somewhat with PR:L in the CVSS vector - verify with Oracle whether some pre-authentication exposure exists.

An attacker who has obtained a low-privileged WebCenter Content account (for example, a basic authenticated user) sends crafted HTTP requests to the Content Server component to bypass access controls and read or tamper with content beyond their authorization. Because of the scope change, the attacker may leverage the compromised component to affect adjacent Fusion Middleware resources. Exploitation is rated difficult (AC:H), so it likely requires specific conditions or repeated attempts, and no public POC is known at time of analysis.