Oracle WebCenter Content EUVD-2026-47023

Exploitation requires network HTTP access to the Oracle WebCenter Content Content Server and, critically, human interaction from a person other than the attacker (CVSS UI:R) - a victim must click, open, or render attacker-supplied content in the WebCenter web interface. No authentication is required of the attacker (PR:N), and the affected versions are the default supported releases 12.2.1.4.0 and 14.1.2.0.0, so no non-default configuration is stated as a prerequisite. The primary limiting factor is the mandatory user-interaction step, which prevents fully automated, unattended exploitation; reachability of the Content Server web endpoint from the attacker's network position is the other gating condition.

The signals are moderately strong but not top-tier for automated mass exploitation. The CVSS vector shows a network attack vector, low complexity and no privileges required (AV:N/AC:L/PR:N), which drives severity up, but UI:R means a victim must be tricked into an action, so exploitation is not fully automatable and depends on social engineering. No EPSS score, KEV listing, or POC is present in the provided data, so there is currently no evidence of active or widespread exploitation - this reads as a high-severity Oracle CPU fix rather than a confirmed in-the-wild threat. The stated outcome ('takeover') with C:H/I:H/A:H is consistent with the 8.8 score, though the tag 'Information Disclosure' is narrower than the description's 'takeover' claim - a discrepancy worth verifying against the Oracle advisory.

An attacker crafts a malicious link or document and delivers it (for example via email or a shared page) to a user of the WebCenter Content web interface; when that user interacts with it, the payload executes in the Content Server context and grants the attacker control of the instance. No public proof-of-concept is available, and the low attack complexity means that once a working payload exists, only a single victim interaction is needed.