Oracle WebCenter Content EUVD-2026-47013

Exploitation requires network access to the Oracle WebCenter Content server over HTTP and a low-privileged authenticated foothold (CVSS PR:L), targeting the Web Content Management component of supported versions 12.2.1.4.0 or 14.1.2.0.0; no user interaction and no high privileges are needed (UI:N, AC:L), so any valid low-level account is sufficient. The limiting factors that reduce real-world risk are: the attacker must first be able to reach the WebCenter Content HTTP interface (internal-only deployments behind VPN/segmentation are far harder to reach) and must possess at least low-privileged credentials on an affected version - the 'Authentication Bypass' intelligence tag suggests that credential requirement may be circumventable, which should be confirmed with Oracle. Impact is confined to confidentiality and integrity of WebCenter-accessible data; there is no availability/denial-of-service effect (A:N).

The signals are moderately strong but not top-tier urgent. CVSS 3.1 is 8.1 (High): network vector, low attack complexity, only low privileges required, no user interaction, unchanged scope, with full C and I loss but no availability impact - meaning an attacker who already holds any low-level account can pivot to broad data theft and tampering easily. However, PR:L means this is not fully unauthenticated despite the 'Authentication Bypass' tag, which is a mild conflict: verify with Oracle whether a low-privileged foothold is truly required or whether an auth-bypass path lowers that bar. Countervailing the high CVSS: it is NOT in CISA KEV, no POC or public exploit is identified, and no EPSS score was supplied, so there is no current evidence of active or imminent exploitation. Net: a real patch priority for internet-exposed or multi-tenant WebCenter deployments given the low privilege bar and full C/I impact, but absent KEV/POC/EPSS data it is a 'patch on next cycle, prioritize if externally exposed' rather than an emergency zero-day.

An attacker who holds or obtains any low-privileged WebCenter Content account (or leverages the flagged authentication-bypass path) sends crafted HTTP requests to the Web Content Management endpoints and, because of the authorization weakness, reads or alters content that should be outside their privilege level. With low attack complexity and no user interaction required, they can exfiltrate sensitive documents and tamper with or delete published content across all content-server-accessible data. No public proof-of-concept has been identified at time of analysis.