Oracle WebCenter Content EUVD-2026-79706

Requires a local, authenticated low-privileged account on the infrastructure where Oracle WebCenter Content executes (AV:L/PR:L) - this is the primary limiting factor and rules out remote unauthenticated exploitation. No user interaction is needed (UI:N) and no special non-default feature toggle is named beyond running the Content Server component of WebCenter Content 12.2.1.4.0 or 14.1.2.0.0. Realistic risk is therefore confined to multi-user or shared hosts where untrusted local logons exist, or as a post-compromise escalation step after an initial foothold.

This is a genuine but locally-scoped critical-impact issue, not a remote-drive-by. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is driven by full confidentiality, integrity and availability impact ('takeover'), but the AV:L (local) and PR:L (low-privilege authenticated) metrics are the decisive risk limiters: an attacker must already have logon access to the host where Oracle WebCenter Content runs. That places it well below the network-exploitable, unauthenticated 9.8-10.0 members of the same Oracle September 2026 CPU cluster (e.g. CVE-2026-83021 WebLogic Web Container). No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so there is no signal of active or automatable exploitation - consistent with Oracle's opaque CPU disclosure style (zero technical detail). The tag 'Information Disclosure' conflicts with the actual C:H/I:H/A:H full-triad takeover and should be treated as a mislabel rather than a scope narrowing. Bottom line: prioritize as an important patch for internet-facing/multi-user WebCenter Content hosts where untrusted local accounts exist, but it is not an emergency remote-exploitation event; the local-access precondition materially reduces real-world urgency relative to the raw 7.8.

An attacker who already holds a low-privileged local account on the server running Oracle WebCenter Content (e.g. an application operator, a compromised service account, or a foothold from another local flaw) exploits the Content Server component to escalate to full control of the WebCenter Content instance, reading, modifying, or destroying managed content. No user interaction is required. No public exploit code has been identified at time of analysis, so exploitation would require independent research or reverse-engineering of the patch.