Oracle WebCenter Content EUVD-2026-47018

Exploitation requires the attacker to hold at least a low-privilege authenticated account on Oracle WebCenter Content (PR:L, per CVSS vector) with network HTTP reachability to the Content Server component. It further requires human interaction from a person other than the attacker (UI:R) - a legitimate user must open or interact with attacker-supplied content for the attack to succeed. Limiting factors: high attack complexity (AC:H) implies conditions outside the attacker's control must align; only versions 12.2.1.4.0 and 14.1.2.0.0 are named as affected; and the third-party-interaction requirement makes untargeted mass exploitation impractical. Availability is not impacted (A:N).

The signals are mixed and indicate a real but conditional risk rather than a mass-exploitation emergency. CVSS is 7.7 (High), but the vector explicitly encodes difficult exploitation (AC:H) and mandatory human interaction from a third party (UI:R), which sharply limits opportunistic use. The attacker needs only low privileges (PR:L) and network HTTP access (AV:N), and the scope change (S:C) plus C:H/I:H impacts raise the ceiling of damage. No EPSS score, no CISA KEV listing, and no POC are present in the provided data, so there is no evidence of active or automatable exploitation. Availability is unaffected (A:N). Net: patch within the normal Oracle CPU cycle, prioritizing internet-reachable or multi-tenant WebCenter deployments, but this is not a drop-everything issue absent exploitation evidence. Oracle CPU advisories intentionally omit technical detail, so the exact attack mechanism cannot be independently verified from this input.

A low-privileged attacker with a valid WebCenter Content account crafts malicious content and lures a higher-privileged user into opening or interacting with it over HTTP; the interaction executes in the victim's authenticated context, letting the attacker read or modify critical content and pivot across the scope boundary into other Fusion Middleware products. The high attack complexity (AC:H) and required human interaction (UI:R) mean the attacker must reliably social-engineer a specific victim, and no public POC is currently known.