Oracle WebCenter Content EUVD-2026-47019

Exploitation requires network access to the Oracle WebCenter Content Server over HTTP with no authentication (PR:N), but it is gated by two concrete limiting factors stated by Oracle: successful attacks require human interaction from a person other than the attacker (UI:R) - i.e., a victim user must open or act on attacker-supplied content/link - and the attack is 'difficult to exploit' with high complexity (AC:H), implying conditions outside the attacker's direct control must line up. Affected deployments are limited to Content Server in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0; instances not exposed to the attacker's reachable network, or where users cannot be induced to interact, are substantially harder to exploit. No specific non-default feature toggle is named in the description, so assume default HTTP-facing Content Server exposure is sufficient technically, with the human-interaction step as the primary real-world barrier.

Signals are moderate and internally consistent: the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.5 (High) - network reachable and unauthenticated (PR:N), but deliberately dampened by high attack complexity (AC:H) and required user interaction (UI:R), which Oracle summarizes as 'difficult to exploit.' Impact is maximal (complete takeover), so if the interaction succeeds the consequences are severe. No EPSS score, SSVC decision, KEV listing, or POC was provided, so there is no evidence of active or automatable exploitation; the absence of these does not prove safety but argues against opportunistic mass exploitation. Net: this is a real but conditional priority - patch it on Oracle's normal Critical Patch Update cadence and prioritize internet-exposed instances, while recognizing the human-interaction requirement makes drive-by, wormable exploitation unlikely. Note one point to verify with the vendor: the 'Information Disclosure' tag understates the stated full C/I/A takeover, so treat 'takeover' (per the description and vector) as the governing impact.

An attacker crafts a malicious HTTP request or link that targets an internet- or intranet-reachable Oracle WebCenter Content Server and delivers it to a legitimate user (for example via a phishing email or a planted link). When that user opens or interacts with the crafted content, the flaw triggers in the Content Server request path and escalates to full compromise of the WebCenter Content instance. No public exploit code is identified at time of analysis, and the high attack complexity means the attacker must satisfy specific conditions and reliably win the user-interaction step.