Oracle WebCenter Content EUVD-2026-47000

Exploitation requires network access to the Oracle WebCenter Content Server over HTTP and, critically, human interaction from a person other than the attacker (UI:R) - a legitimate user must click, open, or otherwise interact with attacker-supplied content for the attack to succeed. No authentication or prior privileges are needed by the attacker (PR:N), and attack complexity is low (AC:L). The limiting factor is that a passive server with no user engagement cannot be compromised; the attack fails without a victim's action. Affects only Content Server in WebCenter Content 12.2.1.4.0 and 14.1.2.0.0, so environments on other versions or with the web tier isolated from untrusted users face reduced exposure.

The CVSS 3.1 base score is 7.6 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L: network reachable, low complexity, no privileges required, but mandatory user interaction, which is the single largest mitigating factor keeping this out of the critical range. The high confidentiality impact paired with only low integrity and availability impact suggests the primary threat is data disclosure rather than full system takeover. No EPSS score, SSVC decision, KEV listing, or POC was provided, so real-world exploitation probability cannot be quantified and there is no public exploit identified at time of analysis; the risk is therefore currently theoretical-but-credible. Note a data conflict: the intelligence tags include 'Authentication Bypass' and 'Denial Of Service', yet the CVSS vector shows PR:N (already unauthenticated, so nothing to bypass) and only A:L (partial DoS, not full) - treat those tags as loose categorization, not confirmed capability, and defer to the CVSS vector.

An attacker crafts a malicious link or content object that targets the WebCenter Content Server and delivers it to an authorized user (for example via email or a shared document reference). When the victim opens or interacts with it in their authenticated session, the attacker's payload executes in that context, exfiltrating sensitive repository data and making limited unauthorized modifications. No public POC was provided, so this scenario is inferred from the CVSS vector (AV:N, UI:R, C:H).