Oracle WebCenter Content EUVD-2026-47009

Exploitation requires the attacker to already hold a low-privileged authenticated account on the WebCenter Content instance (PR:L) and network HTTP reachability to the Web Content Management component. Critically, the attack cannot succeed autonomously: it needs interaction from a person other than the attacker (UI:R) - i.e., a victim user must be tricked into viewing or acting on attacker-supplied content or a request. Limiting factors are therefore the need for valid credentials and successful social engineering of a second, typically more privileged, user; there is no evidence exploitation works against a fully unauthenticated or non-interactive scenario. Affected only for versions 12.2.1.4.0 and 14.1.2.0.0.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0) indicates a network-reachable, low-complexity attack that nonetheless needs both some authentication (PR:L) and interaction from a second human (UI:R), which meaningfully lowers real-world exploitability versus a pure unauthenticated RCE. No EPSS score, POC, or KEV status was supplied, so probabilistic exploitation likelihood cannot be quantified from the input; absence of KEV and POC means this is a high-CVSS issue without confirmed exploitation signal. The 'takeover' language and triple-High impacts justify prioritization for internet-exposed WebCenter instances, but the PR:L + UI:R gating suggests targeted rather than mass, automatable exploitation. No SSVC decision data was provided.

An attacker who holds a low-privilege WebCenter Content account plants or crafts malicious web content or a request, then induces a higher-privileged user (e.g., a content administrator) to view or act on it over HTTP. When the victim interacts, the payload executes in their context and yields full takeover of the WebCenter Content instance. No public POC was identified in the provided data.