Webcenter Content
Monthly
Remote exploitation of Oracle WebCenter Content's Content Server component allows unauthenticated network attackers to compromise confidentiality, integrity, and availability of the platform when a victim user interacts with a malicious payload delivered over HTTP. Both actively supported versions - 12.2.1.4.0 and 14.1.2.0.0 - are affected, and successful exploitation produces a scope change, meaning impacts can propagate beyond the directly targeted WebCenter Content instance to adjacent products within the Fusion Middleware stack. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a credible threat in internet-exposed deployments.
Local authentication bypass in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows any user with OS-level logon access to the hosting infrastructure to read all data managed by the Content Server component without Oracle application credentials. The scope change designation (S:C in the CVSS vector) indicates successful exploitation may further compromise additional Oracle Fusion Middleware products co-located on the same host. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Local privilege escalation in Oracle WebCenter Content's Content Server component allows low-privileged infrastructure users to achieve full system takeover across versions 12.2.1.4.0 and 14.1.2.0.0. Oracle classifies this as 'easily exploitable,' requiring only a low-privileged local logon to the host server - no network access or user interaction needed - with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the severity of the takeover outcome and low exploitation complexity elevate practical risk for affected deployments.
Full system takeover of Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by a low-privileged, network-connected attacker exploiting the Content Server component via HTTP, provided a separate victim user performs some form of interaction. Despite the severe outcome - complete compromise of confidentiality, integrity, and availability - the CVSS vector signals above-average exploitation complexity (AC:H) and a mandatory human-interaction requirement (UI:R), meaning opportunistic, automated attacks are unlikely. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Remote authentication bypass in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to gain unauthorized access to all content managed by the platform and perform limited data modification, provided a victim user interacts with attacker-controlled material. The Oracle August 2026 CPU advisory confirms both supported release trains are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of unauthenticated network access, low complexity, and a high confidentiality impact makes this a priority patch for any Oracle Fusion Middleware deployment.
Unauthorized data exposure in Oracle WebCenter Content's Content Server allows authenticated low-privileged users to access critical or complete enterprise content data over HTTP, with a CVSS 3.1 scope change (S:C) signaling collateral impact on additional Oracle Fusion Middleware components in the same environment. Affecting supported versions 14.1.2.0.0 and 12.2.1.4.0, the vulnerability is tagged as an authentication bypass and carries a CVSS 3.1 score of 7.7, reflecting low attack complexity and no user interaction once a valid account is held. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the straightforward exploitation conditions make patching urgent for environments with broadly distributed low-privileged accounts.
Oracle WebCenter Content's Content Server component, in versions 14.1.2.0.0 and 12.2.1.4.0, exposes an authentication bypass that allows a low-privileged remote attacker to achieve full confidentiality and integrity compromise of all accessible content data - and, due to a confirmed scope change, may significantly impact additional Oracle Fusion Middleware products integrated with the platform. Exploitation is network-accessible over HTTP with low complexity but requires a valid low-privileged account and human interaction from a separate victim, classifying this as a socially-engineered or CSRF-class attack surface. No public exploit code and no CISA KEV listing have been identified at time of analysis; the vulnerability was disclosed as part of Oracle's August 2026 Critical Security Patch Update.
Unauthorized data access and tampering in Oracle WebCenter Content's Content Server component allows unauthenticated remote attackers to fully read or manipulate all managed content via HTTP. Both supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and successful exploitation can cascade beyond the Content Server itself to impact additional Oracle Fusion Middleware products within the same deployment environment. No public exploit has been identified at time of analysis, but the unauthenticated network vector combined with a scope change rating makes this a high-priority item for any organization running this ECM platform.
Authentication bypass in Oracle WebCenter Content's Content Server component allows unauthenticated attackers with adjacent network access to fully compromise data confidentiality and integrity across versions 12.2.1.4.0 and 14.1.2.0.0. The scope change designation confirms that successful exploitation can cascade beyond WebCenter Content itself to additional Oracle Fusion Middleware products. Disclosed via Oracle's August 2026 Critical Security Patch Update, with no public exploit identified at time of analysis.
Oracle WebCenter Content's Content Server component, within the Oracle Fusion Middleware stack, exposes a network-reachable integrity compromise affecting versions 12.2.1.4.0 and 14.1.2.0.0. High-privileged authenticated attackers can access the service via HTTP to arbitrarily create, delete, or modify critical repository data, read a subset of accessible content, and cause partial denial of service - with a confirmed scope change indicating potential cascading impact on additional Oracle Fusion Middleware products. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle WebCenter Content's Content Server component, in versions 12.2.1.4.0 and 14.1.2.0.0, contains an authentication bypass vulnerability reachable over HTTP without credentials, carrying a CVSS 3.1 base score of 8.7. Successful exploitation enables an unauthenticated remote attacker to gain both full read access and full create/delete/modify access to critical content data, with a confirmed scope change meaning downstream Oracle Fusion Middleware components may also be impacted. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the Authentication Bypass tag and high attack complexity signal a non-trivial but realistic threat to unpatched deployments.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 expose a high-complexity, network-accessible flaw in the Content Server component that allows low-privileged authenticated attackers to gain unauthorized read access to critical content data and perform limited data manipulation. The vulnerability carries a scope-change designation, meaning successful exploitation can extend impact beyond WebCenter Content itself to adjacent Oracle Fusion Middleware products. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, though the 'Authentication Bypass' tag from ENISA EUVD introduces residual uncertainty about the true privilege prerequisite.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 expose a network-accessible, unauthenticated vulnerability in the Content Server component that can be triggered via HTTP with user interaction, resulting in a scope change affecting additional products. Successful exploitation grants attackers complete read access to all data accessible within Oracle WebCenter Content and limited write capabilities (insert/update/delete) against some accessible data. No public exploit or CISA KEV listing has been identified at time of analysis, though the Oracle-assigned tag of 'Authentication Bypass' and the high CVSS score of 8.2 warrant prompt patching within Oracle Critical Patch Update cycles.
Remote authentication bypass in Oracle WebCenter Content's Content Server component allows unauthenticated network attackers to fully compromise confidentiality and integrity of managed content - including unauthorized creation, deletion, and modification of critical data - across both affected release lines 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope-change flag (S:C) indicates successful exploitation can cascade to affect additional Oracle Fusion Middleware products beyond WebCenter Content itself. Attack complexity is rated High (AC:H), meaning specific and difficult-to-reproduce conditions must be met, but no authentication or user interaction is required. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle WebCenter Content's Content Server component harbors an authentication bypass exploitable by unauthenticated remote attackers over HTTP, affecting both actively supported versions (12.2.1.4.0 and 14.1.2.0.0) of this Oracle Fusion Middleware product. Successful exploitation grants complete unauthorized read and write access to all content managed by the system, with a confirmed scope change that can extend impact to additional Oracle Fusion Middleware products in the same deployment. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated network vector paired with high confidentiality and integrity impacts makes this a meaningful risk for organizations running exposed affected deployments.
Unauthorized read and write access to critical enterprise content data is achievable in Oracle WebCenter Content's Content Server component via an authentication bypass exploitable over HTTP. Affecting versions 12.2.1.4.0 and 14.1.2.0.0, an unauthenticated remote attacker who overcomes the high attack complexity barrier can exfiltrate all accessible content or create, modify, and delete critical records. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local privilege exploitation in Oracle WebCenter Content 14.1.2.0.0 enables a low-privileged, authenticated user with system logon access to fully compromise the Content Server component. The attacker can read, create, delete, or modify all data accessible within Oracle WebCenter Content, and the confirmed scope change means attacks can cascade into additional co-hosted Oracle Fusion Middleware products. No public exploit has been identified at time of analysis, but the low attack complexity and wide data impact make this a high-priority patch target for any environment running this middleware version.
Oracle WebCenter Content's Content Server component in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is exploitable by a low-privileged authenticated attacker over HTTP who can lure a higher-privileged victim into interacting with malicious content, resulting in unauthorized access to critical data and partial data manipulation with confirmed scope impact beyond WebCenter Content itself. Tagged as an authentication bypass by Oracle, this vulnerability carries a CVSS 3.1 base score of 7.6 and is classified as easily exploitable in Oracle's August 2026 Critical Patch Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote access to all confidential data managed by Oracle WebCenter Content's Content Server component is achievable across two currently supported Fusion Middleware release lines. Tagged as an authentication bypass, this vulnerability allows a network-accessible attacker to read sensitive documents and managed content by sending HTTP requests without supplying any credentials, requiring no user interaction and no elevated privileges. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-authentication, low-complexity attack profile makes this a high-priority remediation item for any deployment reachable from untrusted network segments.
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to fully read, create, modify or delete all Content Server-accessible data and cause a partial denial of service. Oracle rates it CVSS 9.6, driven by a scope change (S:C) meaning successful attacks can significantly impact products beyond WebCenter Content itself. Exploitation requires tricking a legitimate user into an action (UI:R); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated network exploitation of Oracle WebCenter Content's Content Server component allows a remote attacker to achieve full confidentiality and integrity compromise of all accessible content data, with a scope change that can significantly impact additional Oracle Fusion Middleware products in the same environment. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, addressed in Oracle's Critical Patch Update of August 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Authentication Bypass tag and PR:N vector confirm no credentials are required to initiate an attack. The AC:H rating indicates exploitation is non-trivial and requires meeting specific, undisclosed conditions.
Full compromise of Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 is possible over HTTP by an unauthenticated remote attacker who lures a legitimate user into interacting with malicious content. Rated CVSS 3.1 8.8 with high confidentiality, integrity and availability impact, the flaw can lead to full takeover of the WebCenter Content instance. Disclosed via Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation to full takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) lets a low-privileged, network-based attacker fully compromise the server over HTTP. Because the CVSS vector marks a scope change (S:C), a successful attack can significantly impact additional products beyond WebCenter Content itself, driving the near-maximal 9.9 base score. No public exploit identified at time of analysis, but the ease of exploitation (AC:L, PR:L) and complete confidentiality, integrity, and availability impact make this a top-priority patch in Oracle's July 2026 Critical Patch Update.
Full product takeover of Oracle WebCenter Content (Content Server component) in versions 12.2.1.4.0 and 14.1.2.0.0 can be achieved by an unauthenticated remote attacker over HTTP, but only by luring a separate user into an interaction that triggers the flaw. Rated CVSS 3.1 7.5 with high confidentiality, integrity, and availability impact, the issue is classified 'difficult to exploit' due to high attack complexity and the required human interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the practical risk is gated by the social-engineering step despite the severe potential impact.
Cross-context data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-reachable attacker read and alter critical data after tricking a legitimate user into interacting with malicious content. Because the flaw crosses a security scope boundary (S:C), successful attacks can significantly impact products beyond WebCenter Content itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.7; no public exploit identified at time of analysis.
Full compromise of Oracle WebCenter Content is possible in versions 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component of Oracle Fusion Middleware), where a low-privileged, network-adjacent attacker sending crafted HTTP requests can escalate to complete takeover of the product with high confidentiality, integrity, and availability impact. Oracle rates this 8.8 (CVSS 3.1) and describes it as 'easily exploitable,' meaning any authenticated user with minimal privileges can seize the system. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'takeover' outcome make it a priority patch.
Privilege-based full compromise of Oracle WebCenter Content (Web Content Management component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-authenticated attacker take over the entire product over HTTP. Oracle rates it CVSS 3.1 8.8 with High confidentiality, integrity, and availability impact, and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and 'takeover' outcome make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Account takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged attacker with HTTP network access fully compromise the server. The CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle WebCenter Content (Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to read, create, modify, or delete all content-server-accessible data. Oracle rates this 8.1 (High) with confidentiality and integrity fully impacted but no availability effect, and the intelligence tags flag an authentication-bypass angle. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the July 2026 Oracle Critical Patch Update.
Account and system takeover in Oracle WebCenter Content (Fusion Middleware Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-based attacker to fully compromise the product when a legitimate user is tricked into interacting with attacker-supplied content. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.0 and full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' framing make it a high-priority patch item.
Full takeover of Oracle WebCenter Content (Web Content Management component) is possible when a remote, unauthenticated attacker lures a victim into interacting with malicious content over HTTP. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Oracle's own Critical Patch Update process (July 2026).
Account/instance takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the product after luring a victim user into an action. Oracle rates it CVSS 3.1 8.0 with High impact to confidentiality, integrity, and availability, and the ecalert tag flags Information Disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Unauthenticated data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware Web Content Management component) lets a remote attacker read, create, delete, or modify all data accessible to the product over HTTP with no credentials or user interaction. Oracle rates it CVSS 9.1 (C:H/I:H) and vendor tags describe it as an authentication bypass, making it a high-priority patch from the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full application takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-based attacker to compromise confidentiality, integrity, and availability once a legitimate user is tricked into interacting with attacker-influenced content. The flaw carries an Oracle-assigned CVSS 3.1 score of 8.0 (AV:N/AC:L/PR:L/UI:R) and is addressed in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sensitive data disclosure in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) lets a low-privileged, network-based attacker read or fully access all data the application can reach and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 7.1 and describes it as easily exploitable, though it requires an existing low-level account (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Fusion Middleware, Web Content Management component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged, network-authenticated attacker who lures a victim into a triggering action can achieve complete takeover of the product with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). Oracle rates the flaw as easily exploitable over HTTP but conditions it on human interaction from a second party. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content (Fusion Middleware, Web Content Management component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with HTTP network access can escalate to complete takeover of the product with confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable, though it requires existing high privileges. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.
Full takeover of Oracle WebCenter Content (Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthenticated remote attacker over HTTP, requiring no user interaction. The scope-changing flaw (CVSS 3.1 base 10.0) lets attackers compromise the Web Content Management component and pivot to impact adjacent Oracle products. No public exploit identified at time of analysis, but the maximum severity and trivial exploitability make this a top-priority patch from the July 2026 Oracle Critical Patch Update.
Account/system takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets a low-privileged, authenticated attacker with HTTP network access fully compromise the platform, provided a legitimate user is lured into interacting with attacker-supplied content. Oracle rates it CVSS 3.1 8.0 with full Confidentiality, Integrity, and Availability loss and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'takeover' outcome and low complexity make it a high-priority patch item.
Unauthorized data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to gain access to critical data and cause limited data tampering and partial denial of service, provided a legitimate user is tricked into interacting with the attack. The flaw carries a CVSS 3.1 score of 7.6 and was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access and partial denial of service in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker compromise the platform after tricking a legitimate user into interacting with attacker-controlled content. Per Oracle's July 2026 Critical Patch Update, successful exploitation yields high confidentiality impact (complete read access to WebCenter Content data) plus limited integrity and availability damage. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, though Oracle rates it easily exploitable.
Full takeover of Oracle WebCenter Content (Content Server component) is possible when a remote, unauthenticated attacker lures a legitimate user into interacting with a malicious HTTP request, yielding high confidentiality, integrity, and availability impact plus a scope change to adjacent products. It affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 score of 8.3. No public exploit identified at time of analysis and it is not listed in CISA KEV, though exploitation complexity is high.
Full takeover of Oracle WebCenter Content (Content Server component) in Oracle Fusion Middleware allows a remote unauthenticated attacker to fully compromise confidentiality, integrity, and availability, but only after luring an authenticated victim into interacting with an attacker-supplied trigger (UI:R). It affects supported versions 12.2.1.4.0 and 14.1.2.0.0, carries a CVSS 3.1 base score of 8.8, and is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle WebCenter Content (Content Server component of Oracle Fusion Middleware) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote, unauthenticated attacker sending crafted HTTP traffic can compromise confidentiality, integrity, and availability, but the attack requires human interaction from a user other than the attacker (UI:R). No public exploit has been identified at time of analysis, and the flaw is fixed in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 can be achieved by a remote, unauthenticated attacker over HTTP, provided a legitimate user is lured into a triggering interaction. Rated CVSS 8.8 with high confidentiality, integrity, and availability impact, successful exploitation yields takeover of the WebCenter Content instance. There is no public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and network vector make this a priority patch item.
Full product takeover in Oracle WebCenter Content (Content Server component) 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to compromise confidentiality, integrity, and availability by luring a victim into interacting with a malicious HTTP request or link. The flaw carries a CVSS 3.1 base score of 8.8 and results in complete takeover, but exploitation requires human interaction from a legitimate user. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was fixed in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle WebCenter Content (Content Server component) is possible when an unauthenticated remote attacker over HTTP lures a legitimate user into interacting with malicious content, per Oracle's July 2026 Critical Patch Update. Affected supported releases are 12.2.1.4.0 and 14.1.2.0.0, and the CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but rated high due to the complete-compromise outcome.
Full takeover of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a remote, unauthenticated attacker over HTTP, but only after luring a legitimate user into interacting with attacker-controlled input (UI:R). The CVSS 3.1 base score is 8.8 with High impact to confidentiality, integrity and availability, meaning a successful attack yields complete compromise of the product. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, so exploitation is theoretical rather than confirmed.
Full takeover of Oracle WebCenter Content (Content Server component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is achievable by a remote, unauthenticated attacker over HTTP when a legitimate user is lured into interacting with attacker-influenced content. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R with high Confidentiality, Integrity and Availability impact (8.8), the flaw yields complete compromise of the content management system, though the required human interaction meaningfully narrows practical exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, so exploitation status remains theoretical based on Oracle's July 2026 CPU disclosure.
Scope-changing information disclosure and data tampering in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets an unauthenticated network attacker who lures a victim into a single interaction read or alter all data the product can access. Rated CVSS 3.1 9.3 (C:H/I:H, scope change), the flaw is dangerous because compromise can spill into other integrated Oracle Fusion Middleware products, though availability is unaffected. No public exploit identified at time of analysis and it is not on CISA KEV, so exploitation is currently theoretical but the criticality warrants prompt patching.
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker read and tamper with all Content Server data and pivot into other connected products. Exploitation is network-based over HTTP and requires luring a victim to trigger the attack (UI:R), with a resulting CVSS 3.1 score of 9.3 driven by a scope change and High confidentiality/integrity impact. No public exploit identified at time of analysis; this entry is disclosed via Oracle's July 2026 Critical Patch Update and is not listed in CISA KEV.
Data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-based attacker read, create, delete, or modify all data accessible to the application. Because the flaw carries a scope change, successful exploitation may also significantly impact products beyond WebCenter Content itself. No public exploit identified at time of analysis, and the flaw is rated difficult to exploit (AC:H); Oracle addressed it in the July 2026 Critical Patch Update.
Cross-context data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets a low-privileged, authenticated attacker abuse HTTP-facing functionality to read and modify all Content-Server-accessible data, with a scope change that can significantly impact adjacent Oracle products. Exploitation requires tricking a legitimate user into interacting with attacker-controlled content, and Oracle rates it CVSS 3.1 8.7 (confidentiality and integrity high, no availability impact). Disclosed in Oracle's July 2026 Critical Patch Update with no public exploit identified at time of analysis and not listed in CISA KEV.
Cross-context data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged authenticated attacker with HTTP network access to gain unauthorized read access to all WebCenter Content data and limited write access, provided a separate victim user is tricked into an interaction. Because the CVSS scope is changed (S:C), a successful attack can significantly impact resources beyond WebCenter Content itself, consistent with a stored/reflected injection-style flaw served through the content platform. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vulnerability was reported by Oracle and patched in the July 2026 Critical Patch Update.
Account takeover in Oracle WebCenter Content: Imaging (Core component of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, authenticated attacker with network HTTP access fully compromise the Imaging service. Rated CVSS 8.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as 'easily exploitable' and results in complete takeover of the product. No public exploit identified at time of analysis, and it is not on CISA KEV.
Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with network access over the T3 or IIOP protocols can take over the Imaging application entirely (CVSS 3.1 7.2, high confidentiality, integrity and availability impact). Fixes are delivered in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Privilege-based takeover of Oracle WebCenter Content: Imaging (Core component) in Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-authenticated attacker to fully compromise the product over HTTP, yielding high confidentiality, integrity, and availability impact. Fixed in Oracle's July 2026 Critical Patch Update, this flaw carries a CVSS 3.1 base score of 8.8 and is classed as easily exploitable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible for an unauthenticated attacker positioned on the same physical/adjacent network segment as the host, per Oracle's July 2026 Critical Patch Update (CVE-2026-60471). The flaw carries a CVSS 3.1 base score of 8.3 and, notably, a scope change (S:C) meaning successful exploitation can significantly impact additional products beyond Imaging itself, resulting in takeover. There is no public exploit identified at time of analysis and the issue is not on CISA KEV, but the confidentiality, integrity, and availability impact are all High.
Unauthorized data compromise in Oracle WebCenter Content: Imaging (Core component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all Imaging-accessible data by tricking an authenticated user into interacting with a malicious request. Rated CVSS 3.1 8.7 (High) with a scope change that lets exploitation impact additional connected Oracle Fusion Middleware products beyond Imaging itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; authentication is required (PR:L) plus victim interaction (UI:R), which meaningfully limits mass exploitation.
Scope-changing confidentiality and integrity compromise in Oracle WebCenter Content: Imaging (Core component) affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, letting a low-privileged, network-based attacker who lures an authenticated user into an action read, create, delete, or modify all Imaging-accessible data. Oracle rates it CVSS 3.1 8.7 with a scope change, meaning successful attacks can significantly impact products beyond Imaging itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the Oracle July 2026 Critical Patch Update.
Unauthorized data access and partial data manipulation in Oracle WebCenter Content: Imaging (Fusion Middleware component: Core) lets a low-privileged, network-based attacker read all Imaging-accessible data and modify some of it over HTTP. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, with a CVSS 3.1 base score of 7.1 driven by high confidentiality and low integrity impact. No public exploit identified at time of analysis and the flaw is not on CISA KEV; the Oracle-supplied 'Authentication Bypass' tag is somewhat at odds with the CVSS PR:L requirement and should be verified against the vendor advisory.
Account/application takeover in Oracle WebCenter Content: Imaging (Core component of Fusion Middleware) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, where a remote unauthenticated attacker who lures a legitimate user into interacting with malicious content over HTTP can fully compromise the Imaging application. Oracle rates it CVSS 3.1 7.5 with high confidentiality, integrity, and availability impact, but flags it as difficult to exploit (AC:H) and dependent on user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix ships in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with network access over HTTP can take over the Imaging service, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N) yields a 7.2 base score with high confidentiality, integrity, and availability impact, meaning the attacker gains complete control of the product. No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV, though the vendor tags it under Information Disclosure.
Full compromise of Oracle WebCenter Content: Imaging (Core component) in Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker sending crafted requests over the WebLogic T3 or IIOP protocols. Successful exploitation yields complete takeover of the Imaging service with high confidentiality, integrity, and availability impact (CVSS 8.8). This was disclosed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content: Imaging (versions 12.2.1.4.0 and 14.1.2.0.0), a component of Oracle Fusion Middleware, is achievable by a low-privileged attacker with network HTTP access, per Oracle's July 2026 Critical Patch Update. Successful exploitation results in complete takeover of the Imaging component with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle WebCenter Content: Imaging (Fusion Middleware Core component) allows an unauthenticated attacker with network access via the T3 or IIOP protocols to fully compromise the product, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not yet confirmed in the wild despite the maximal severity.
Full compromise of Oracle WebCenter Content is possible in the Content Server component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a remote unauthenticated attacker reaching the server over HTTP can achieve complete takeover with full confidentiality, integrity, and availability impact. The flaw carries a CVSS 3.1 base score of 8.1, tempered by high attack complexity (AC:H) that makes reliable exploitation difficult. No public exploit identified at time of analysis, and it is not listed in CISA KEV, so risk is currently theoretical pending patch application from the Oracle July 2026 Critical Patch Update.
Privilege-abusing information disclosure and data tampering in Oracle WebCenter Content: Imaging (Core component) lets a low-privileged, network-based attacker read all Imaging-accessible data and modify some of it over HTTP. The flaw carries a scope change (CVSS 8.5), meaning a successful attack can reach beyond the Imaging module into other Fusion Middleware components, and Oracle tags it as an authentication-bypass-class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' and shipped a fix in the July 2026 Critical Patch Update.
Information disclosure and partial data tampering in the Imaging component (Core) of Oracle WebCenter Content, part of Oracle Fusion Middleware, affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with HTTP network access can compromise the Imaging service, gaining unauthorized read access to all Imaging-accessible data and limited unauthorized update, insert, or delete capability, addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis; the record carries an 'Authentication Bypass' tag despite the CVSS requiring low privileges (PR:L).
Full compromise of Oracle WebCenter Content (Content Server component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker with HTTPS network access can achieve complete takeover of the product. The CVSS 3.1 base score is 8.1 with high confidentiality, integrity, and availability impact, though the flaw is rated difficult to exploit (AC:H). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthorized data access in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets an attacker who already holds a login session on the host infrastructure read or take complete access to all data the product can reach, and because of a scope change the impact can extend to additional connected products. Addressed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.1 with confidentiality-only impact; no public exploit is identified at time of analysis and it is not listed in CISA KEV. The Oracle-supplied tag 'Authentication Bypass' suggests the flaw circumvents application-level access controls once local/infrastructure logon is obtained.
Cross-scope data compromise in Oracle WebCenter Content (Content Server component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a remote unauthenticated attacker over HTTP read, create, delete, or modify all data accessible to the Content Server, with a scope change that can significantly impact other integrated Oracle Fusion Middleware products. Oracle rates it CVSS 3.1 8.7 (high complexity) with confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor tags suggest an authentication-bypass class issue.
Sensitive data disclosure and partial data tampering in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged, network-based attacker over HTTP to gain complete read access to all data the product can reach and to modify some of that data. Oracle rates the flaw CVSS 3.1 8.5 with a scope change, meaning exploitation can significantly impact adjacent products beyond WebCenter Content itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so treat this as a high-severity but not confirmed-exploited issue.
Scope-changing data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-based attacker read, create, delete, or modify all data accessible to the application. Exploitation is rated easy but requires tricking a separate user into an interaction (UI:R), and the flaw crosses a trust boundary to significantly impact additional products (scope change). No public exploit has been identified at time of analysis and it is not on CISA KEV; EPSS was not provided.
Full remote takeover of Oracle WebCenter Content (Fusion Middleware Content Server) is possible when an unauthenticated attacker reaches the HTTP interface, per Oracle's July 2026 Critical Patch Update (CPU). The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0 and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector and Oracle 'takeover' language make it a top-priority patch.
Full compromise of Oracle WebCenter Content is possible via the Content Server component in Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0, where an attacker holding high privileges can send crafted HTTP requests to take over the product with confidentiality, integrity, and availability impact. Oracle rates the flaw CVSS 3.1 7.2 and describes it as easily exploitable once the required privilege level is held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the addressing of it in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.
Full compromise of Oracle WebCenter Content (Content Server component) allows a low-privileged, network-based attacker over HTTP to take over the application, impacting confidentiality, integrity, and availability. Affected releases are 12.2.1.4.0 and 14.1.2.0.0, and the flaw is rated CVSS 3.1 8.8 and characterized by Oracle as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.
Unauthenticated remote compromise of Oracle WebCenter Content: Imaging (component: Core) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows attackers to read and modify all data accessible to the Imaging service over HTTP. The flaw is rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, and Oracle classifies it as easily exploitable. No public exploit identified at time of analysis, and the CVE is not currently listed on CISA KEV.
Remote unauthenticated takeover of Oracle WebCenter Content: Imaging (versions 12.2.1.4.0 and 14.1.2.0.0) is possible via HTTP, per Oracle's June 2026 Critical Patch Update. With a CVSS 3.1 base score of 9.8 and AV:N/AC:L/PR:N/UI:N, the flaw in the Core component enables full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Account takeover in Oracle WebCenter Content: Imaging (Fusion Middleware) allows a low-privileged authenticated attacker with HTTP network access to fully compromise the Imaging component on versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates the flaw CVSS 8.8 with high impact across confidentiality, integrity, and availability, and describes it as 'easily exploitable.' No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 86.3%.
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Remote exploitation of Oracle WebCenter Content's Content Server component allows unauthenticated network attackers to compromise confidentiality, integrity, and availability of the platform when a victim user interacts with a malicious payload delivered over HTTP. Both actively supported versions - 12.2.1.4.0 and 14.1.2.0.0 - are affected, and successful exploitation produces a scope change, meaning impacts can propagate beyond the directly targeted WebCenter Content instance to adjacent products within the Fusion Middleware stack. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a credible threat in internet-exposed deployments.
Local authentication bypass in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows any user with OS-level logon access to the hosting infrastructure to read all data managed by the Content Server component without Oracle application credentials. The scope change designation (S:C in the CVSS vector) indicates successful exploitation may further compromise additional Oracle Fusion Middleware products co-located on the same host. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Local privilege escalation in Oracle WebCenter Content's Content Server component allows low-privileged infrastructure users to achieve full system takeover across versions 12.2.1.4.0 and 14.1.2.0.0. Oracle classifies this as 'easily exploitable,' requiring only a low-privileged local logon to the host server - no network access or user interaction needed - with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the severity of the takeover outcome and low exploitation complexity elevate practical risk for affected deployments.
Full system takeover of Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by a low-privileged, network-connected attacker exploiting the Content Server component via HTTP, provided a separate victim user performs some form of interaction. Despite the severe outcome - complete compromise of confidentiality, integrity, and availability - the CVSS vector signals above-average exploitation complexity (AC:H) and a mandatory human-interaction requirement (UI:R), meaning opportunistic, automated attacks are unlikely. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Remote authentication bypass in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to gain unauthorized access to all content managed by the platform and perform limited data modification, provided a victim user interacts with attacker-controlled material. The Oracle August 2026 CPU advisory confirms both supported release trains are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of unauthenticated network access, low complexity, and a high confidentiality impact makes this a priority patch for any Oracle Fusion Middleware deployment.
Unauthorized data exposure in Oracle WebCenter Content's Content Server allows authenticated low-privileged users to access critical or complete enterprise content data over HTTP, with a CVSS 3.1 scope change (S:C) signaling collateral impact on additional Oracle Fusion Middleware components in the same environment. Affecting supported versions 14.1.2.0.0 and 12.2.1.4.0, the vulnerability is tagged as an authentication bypass and carries a CVSS 3.1 score of 7.7, reflecting low attack complexity and no user interaction once a valid account is held. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the straightforward exploitation conditions make patching urgent for environments with broadly distributed low-privileged accounts.
Oracle WebCenter Content's Content Server component, in versions 14.1.2.0.0 and 12.2.1.4.0, exposes an authentication bypass that allows a low-privileged remote attacker to achieve full confidentiality and integrity compromise of all accessible content data - and, due to a confirmed scope change, may significantly impact additional Oracle Fusion Middleware products integrated with the platform. Exploitation is network-accessible over HTTP with low complexity but requires a valid low-privileged account and human interaction from a separate victim, classifying this as a socially-engineered or CSRF-class attack surface. No public exploit code and no CISA KEV listing have been identified at time of analysis; the vulnerability was disclosed as part of Oracle's August 2026 Critical Security Patch Update.
Unauthorized data access and tampering in Oracle WebCenter Content's Content Server component allows unauthenticated remote attackers to fully read or manipulate all managed content via HTTP. Both supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and successful exploitation can cascade beyond the Content Server itself to impact additional Oracle Fusion Middleware products within the same deployment environment. No public exploit has been identified at time of analysis, but the unauthenticated network vector combined with a scope change rating makes this a high-priority item for any organization running this ECM platform.
Authentication bypass in Oracle WebCenter Content's Content Server component allows unauthenticated attackers with adjacent network access to fully compromise data confidentiality and integrity across versions 12.2.1.4.0 and 14.1.2.0.0. The scope change designation confirms that successful exploitation can cascade beyond WebCenter Content itself to additional Oracle Fusion Middleware products. Disclosed via Oracle's August 2026 Critical Security Patch Update, with no public exploit identified at time of analysis.
Oracle WebCenter Content's Content Server component, within the Oracle Fusion Middleware stack, exposes a network-reachable integrity compromise affecting versions 12.2.1.4.0 and 14.1.2.0.0. High-privileged authenticated attackers can access the service via HTTP to arbitrarily create, delete, or modify critical repository data, read a subset of accessible content, and cause partial denial of service - with a confirmed scope change indicating potential cascading impact on additional Oracle Fusion Middleware products. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle WebCenter Content's Content Server component, in versions 12.2.1.4.0 and 14.1.2.0.0, contains an authentication bypass vulnerability reachable over HTTP without credentials, carrying a CVSS 3.1 base score of 8.7. Successful exploitation enables an unauthenticated remote attacker to gain both full read access and full create/delete/modify access to critical content data, with a confirmed scope change meaning downstream Oracle Fusion Middleware components may also be impacted. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the Authentication Bypass tag and high attack complexity signal a non-trivial but realistic threat to unpatched deployments.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 expose a high-complexity, network-accessible flaw in the Content Server component that allows low-privileged authenticated attackers to gain unauthorized read access to critical content data and perform limited data manipulation. The vulnerability carries a scope-change designation, meaning successful exploitation can extend impact beyond WebCenter Content itself to adjacent Oracle Fusion Middleware products. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, though the 'Authentication Bypass' tag from ENISA EUVD introduces residual uncertainty about the true privilege prerequisite.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 expose a network-accessible, unauthenticated vulnerability in the Content Server component that can be triggered via HTTP with user interaction, resulting in a scope change affecting additional products. Successful exploitation grants attackers complete read access to all data accessible within Oracle WebCenter Content and limited write capabilities (insert/update/delete) against some accessible data. No public exploit or CISA KEV listing has been identified at time of analysis, though the Oracle-assigned tag of 'Authentication Bypass' and the high CVSS score of 8.2 warrant prompt patching within Oracle Critical Patch Update cycles.
Remote authentication bypass in Oracle WebCenter Content's Content Server component allows unauthenticated network attackers to fully compromise confidentiality and integrity of managed content - including unauthorized creation, deletion, and modification of critical data - across both affected release lines 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope-change flag (S:C) indicates successful exploitation can cascade to affect additional Oracle Fusion Middleware products beyond WebCenter Content itself. Attack complexity is rated High (AC:H), meaning specific and difficult-to-reproduce conditions must be met, but no authentication or user interaction is required. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle WebCenter Content's Content Server component harbors an authentication bypass exploitable by unauthenticated remote attackers over HTTP, affecting both actively supported versions (12.2.1.4.0 and 14.1.2.0.0) of this Oracle Fusion Middleware product. Successful exploitation grants complete unauthorized read and write access to all content managed by the system, with a confirmed scope change that can extend impact to additional Oracle Fusion Middleware products in the same deployment. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated network vector paired with high confidentiality and integrity impacts makes this a meaningful risk for organizations running exposed affected deployments.
Unauthorized read and write access to critical enterprise content data is achievable in Oracle WebCenter Content's Content Server component via an authentication bypass exploitable over HTTP. Affecting versions 12.2.1.4.0 and 14.1.2.0.0, an unauthenticated remote attacker who overcomes the high attack complexity barrier can exfiltrate all accessible content or create, modify, and delete critical records. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local privilege exploitation in Oracle WebCenter Content 14.1.2.0.0 enables a low-privileged, authenticated user with system logon access to fully compromise the Content Server component. The attacker can read, create, delete, or modify all data accessible within Oracle WebCenter Content, and the confirmed scope change means attacks can cascade into additional co-hosted Oracle Fusion Middleware products. No public exploit has been identified at time of analysis, but the low attack complexity and wide data impact make this a high-priority patch target for any environment running this middleware version.
Oracle WebCenter Content's Content Server component in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is exploitable by a low-privileged authenticated attacker over HTTP who can lure a higher-privileged victim into interacting with malicious content, resulting in unauthorized access to critical data and partial data manipulation with confirmed scope impact beyond WebCenter Content itself. Tagged as an authentication bypass by Oracle, this vulnerability carries a CVSS 3.1 base score of 7.6 and is classified as easily exploitable in Oracle's August 2026 Critical Patch Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote access to all confidential data managed by Oracle WebCenter Content's Content Server component is achievable across two currently supported Fusion Middleware release lines. Tagged as an authentication bypass, this vulnerability allows a network-accessible attacker to read sensitive documents and managed content by sending HTTP requests without supplying any credentials, requiring no user interaction and no elevated privileges. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-authentication, low-complexity attack profile makes this a high-priority remediation item for any deployment reachable from untrusted network segments.
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to fully read, create, modify or delete all Content Server-accessible data and cause a partial denial of service. Oracle rates it CVSS 9.6, driven by a scope change (S:C) meaning successful attacks can significantly impact products beyond WebCenter Content itself. Exploitation requires tricking a legitimate user into an action (UI:R); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated network exploitation of Oracle WebCenter Content's Content Server component allows a remote attacker to achieve full confidentiality and integrity compromise of all accessible content data, with a scope change that can significantly impact additional Oracle Fusion Middleware products in the same environment. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, addressed in Oracle's Critical Patch Update of August 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Authentication Bypass tag and PR:N vector confirm no credentials are required to initiate an attack. The AC:H rating indicates exploitation is non-trivial and requires meeting specific, undisclosed conditions.
Full compromise of Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 is possible over HTTP by an unauthenticated remote attacker who lures a legitimate user into interacting with malicious content. Rated CVSS 3.1 8.8 with high confidentiality, integrity and availability impact, the flaw can lead to full takeover of the WebCenter Content instance. Disclosed via Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation to full takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) lets a low-privileged, network-based attacker fully compromise the server over HTTP. Because the CVSS vector marks a scope change (S:C), a successful attack can significantly impact additional products beyond WebCenter Content itself, driving the near-maximal 9.9 base score. No public exploit identified at time of analysis, but the ease of exploitation (AC:L, PR:L) and complete confidentiality, integrity, and availability impact make this a top-priority patch in Oracle's July 2026 Critical Patch Update.
Full product takeover of Oracle WebCenter Content (Content Server component) in versions 12.2.1.4.0 and 14.1.2.0.0 can be achieved by an unauthenticated remote attacker over HTTP, but only by luring a separate user into an interaction that triggers the flaw. Rated CVSS 3.1 7.5 with high confidentiality, integrity, and availability impact, the issue is classified 'difficult to exploit' due to high attack complexity and the required human interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the practical risk is gated by the social-engineering step despite the severe potential impact.
Cross-context data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-reachable attacker read and alter critical data after tricking a legitimate user into interacting with malicious content. Because the flaw crosses a security scope boundary (S:C), successful attacks can significantly impact products beyond WebCenter Content itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.7; no public exploit identified at time of analysis.
Full compromise of Oracle WebCenter Content is possible in versions 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component of Oracle Fusion Middleware), where a low-privileged, network-adjacent attacker sending crafted HTTP requests can escalate to complete takeover of the product with high confidentiality, integrity, and availability impact. Oracle rates this 8.8 (CVSS 3.1) and describes it as 'easily exploitable,' meaning any authenticated user with minimal privileges can seize the system. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'takeover' outcome make it a priority patch.
Privilege-based full compromise of Oracle WebCenter Content (Web Content Management component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-authenticated attacker take over the entire product over HTTP. Oracle rates it CVSS 3.1 8.8 with High confidentiality, integrity, and availability impact, and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and 'takeover' outcome make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Account takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged attacker with HTTP network access fully compromise the server. The CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle WebCenter Content (Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to read, create, modify, or delete all content-server-accessible data. Oracle rates this 8.1 (High) with confidentiality and integrity fully impacted but no availability effect, and the intelligence tags flag an authentication-bypass angle. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the July 2026 Oracle Critical Patch Update.
Account and system takeover in Oracle WebCenter Content (Fusion Middleware Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-based attacker to fully compromise the product when a legitimate user is tricked into interacting with attacker-supplied content. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.0 and full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' framing make it a high-priority patch item.
Full takeover of Oracle WebCenter Content (Web Content Management component) is possible when a remote, unauthenticated attacker lures a victim into interacting with malicious content over HTTP. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Oracle's own Critical Patch Update process (July 2026).
Account/instance takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the product after luring a victim user into an action. Oracle rates it CVSS 3.1 8.0 with High impact to confidentiality, integrity, and availability, and the ecalert tag flags Information Disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Unauthenticated data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware Web Content Management component) lets a remote attacker read, create, delete, or modify all data accessible to the product over HTTP with no credentials or user interaction. Oracle rates it CVSS 9.1 (C:H/I:H) and vendor tags describe it as an authentication bypass, making it a high-priority patch from the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full application takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-based attacker to compromise confidentiality, integrity, and availability once a legitimate user is tricked into interacting with attacker-influenced content. The flaw carries an Oracle-assigned CVSS 3.1 score of 8.0 (AV:N/AC:L/PR:L/UI:R) and is addressed in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sensitive data disclosure in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) lets a low-privileged, network-based attacker read or fully access all data the application can reach and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 7.1 and describes it as easily exploitable, though it requires an existing low-level account (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Fusion Middleware, Web Content Management component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged, network-authenticated attacker who lures a victim into a triggering action can achieve complete takeover of the product with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). Oracle rates the flaw as easily exploitable over HTTP but conditions it on human interaction from a second party. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content (Fusion Middleware, Web Content Management component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with HTTP network access can escalate to complete takeover of the product with confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable, though it requires existing high privileges. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.
Full takeover of Oracle WebCenter Content (Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthenticated remote attacker over HTTP, requiring no user interaction. The scope-changing flaw (CVSS 3.1 base 10.0) lets attackers compromise the Web Content Management component and pivot to impact adjacent Oracle products. No public exploit identified at time of analysis, but the maximum severity and trivial exploitability make this a top-priority patch from the July 2026 Oracle Critical Patch Update.
Account/system takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets a low-privileged, authenticated attacker with HTTP network access fully compromise the platform, provided a legitimate user is lured into interacting with attacker-supplied content. Oracle rates it CVSS 3.1 8.0 with full Confidentiality, Integrity, and Availability loss and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'takeover' outcome and low complexity make it a high-priority patch item.
Unauthorized data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to gain access to critical data and cause limited data tampering and partial denial of service, provided a legitimate user is tricked into interacting with the attack. The flaw carries a CVSS 3.1 score of 7.6 and was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access and partial denial of service in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker compromise the platform after tricking a legitimate user into interacting with attacker-controlled content. Per Oracle's July 2026 Critical Patch Update, successful exploitation yields high confidentiality impact (complete read access to WebCenter Content data) plus limited integrity and availability damage. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, though Oracle rates it easily exploitable.
Full takeover of Oracle WebCenter Content (Content Server component) is possible when a remote, unauthenticated attacker lures a legitimate user into interacting with a malicious HTTP request, yielding high confidentiality, integrity, and availability impact plus a scope change to adjacent products. It affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 score of 8.3. No public exploit identified at time of analysis and it is not listed in CISA KEV, though exploitation complexity is high.
Full takeover of Oracle WebCenter Content (Content Server component) in Oracle Fusion Middleware allows a remote unauthenticated attacker to fully compromise confidentiality, integrity, and availability, but only after luring an authenticated victim into interacting with an attacker-supplied trigger (UI:R). It affects supported versions 12.2.1.4.0 and 14.1.2.0.0, carries a CVSS 3.1 base score of 8.8, and is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle WebCenter Content (Content Server component of Oracle Fusion Middleware) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote, unauthenticated attacker sending crafted HTTP traffic can compromise confidentiality, integrity, and availability, but the attack requires human interaction from a user other than the attacker (UI:R). No public exploit has been identified at time of analysis, and the flaw is fixed in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 can be achieved by a remote, unauthenticated attacker over HTTP, provided a legitimate user is lured into a triggering interaction. Rated CVSS 8.8 with high confidentiality, integrity, and availability impact, successful exploitation yields takeover of the WebCenter Content instance. There is no public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and network vector make this a priority patch item.
Full product takeover in Oracle WebCenter Content (Content Server component) 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to compromise confidentiality, integrity, and availability by luring a victim into interacting with a malicious HTTP request or link. The flaw carries a CVSS 3.1 base score of 8.8 and results in complete takeover, but exploitation requires human interaction from a legitimate user. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was fixed in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle WebCenter Content (Content Server component) is possible when an unauthenticated remote attacker over HTTP lures a legitimate user into interacting with malicious content, per Oracle's July 2026 Critical Patch Update. Affected supported releases are 12.2.1.4.0 and 14.1.2.0.0, and the CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but rated high due to the complete-compromise outcome.
Full takeover of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a remote, unauthenticated attacker over HTTP, but only after luring a legitimate user into interacting with attacker-controlled input (UI:R). The CVSS 3.1 base score is 8.8 with High impact to confidentiality, integrity and availability, meaning a successful attack yields complete compromise of the product. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, so exploitation is theoretical rather than confirmed.
Full takeover of Oracle WebCenter Content (Content Server component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is achievable by a remote, unauthenticated attacker over HTTP when a legitimate user is lured into interacting with attacker-influenced content. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R with high Confidentiality, Integrity and Availability impact (8.8), the flaw yields complete compromise of the content management system, though the required human interaction meaningfully narrows practical exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, so exploitation status remains theoretical based on Oracle's July 2026 CPU disclosure.
Scope-changing information disclosure and data tampering in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets an unauthenticated network attacker who lures a victim into a single interaction read or alter all data the product can access. Rated CVSS 3.1 9.3 (C:H/I:H, scope change), the flaw is dangerous because compromise can spill into other integrated Oracle Fusion Middleware products, though availability is unaffected. No public exploit identified at time of analysis and it is not on CISA KEV, so exploitation is currently theoretical but the criticality warrants prompt patching.
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker read and tamper with all Content Server data and pivot into other connected products. Exploitation is network-based over HTTP and requires luring a victim to trigger the attack (UI:R), with a resulting CVSS 3.1 score of 9.3 driven by a scope change and High confidentiality/integrity impact. No public exploit identified at time of analysis; this entry is disclosed via Oracle's July 2026 Critical Patch Update and is not listed in CISA KEV.
Data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-based attacker read, create, delete, or modify all data accessible to the application. Because the flaw carries a scope change, successful exploitation may also significantly impact products beyond WebCenter Content itself. No public exploit identified at time of analysis, and the flaw is rated difficult to exploit (AC:H); Oracle addressed it in the July 2026 Critical Patch Update.
Cross-context data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets a low-privileged, authenticated attacker abuse HTTP-facing functionality to read and modify all Content-Server-accessible data, with a scope change that can significantly impact adjacent Oracle products. Exploitation requires tricking a legitimate user into interacting with attacker-controlled content, and Oracle rates it CVSS 3.1 8.7 (confidentiality and integrity high, no availability impact). Disclosed in Oracle's July 2026 Critical Patch Update with no public exploit identified at time of analysis and not listed in CISA KEV.
Cross-context data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged authenticated attacker with HTTP network access to gain unauthorized read access to all WebCenter Content data and limited write access, provided a separate victim user is tricked into an interaction. Because the CVSS scope is changed (S:C), a successful attack can significantly impact resources beyond WebCenter Content itself, consistent with a stored/reflected injection-style flaw served through the content platform. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vulnerability was reported by Oracle and patched in the July 2026 Critical Patch Update.
Account takeover in Oracle WebCenter Content: Imaging (Core component of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, authenticated attacker with network HTTP access fully compromise the Imaging service. Rated CVSS 8.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as 'easily exploitable' and results in complete takeover of the product. No public exploit identified at time of analysis, and it is not on CISA KEV.
Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with network access over the T3 or IIOP protocols can take over the Imaging application entirely (CVSS 3.1 7.2, high confidentiality, integrity and availability impact). Fixes are delivered in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Privilege-based takeover of Oracle WebCenter Content: Imaging (Core component) in Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-authenticated attacker to fully compromise the product over HTTP, yielding high confidentiality, integrity, and availability impact. Fixed in Oracle's July 2026 Critical Patch Update, this flaw carries a CVSS 3.1 base score of 8.8 and is classed as easily exploitable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible for an unauthenticated attacker positioned on the same physical/adjacent network segment as the host, per Oracle's July 2026 Critical Patch Update (CVE-2026-60471). The flaw carries a CVSS 3.1 base score of 8.3 and, notably, a scope change (S:C) meaning successful exploitation can significantly impact additional products beyond Imaging itself, resulting in takeover. There is no public exploit identified at time of analysis and the issue is not on CISA KEV, but the confidentiality, integrity, and availability impact are all High.
Unauthorized data compromise in Oracle WebCenter Content: Imaging (Core component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all Imaging-accessible data by tricking an authenticated user into interacting with a malicious request. Rated CVSS 3.1 8.7 (High) with a scope change that lets exploitation impact additional connected Oracle Fusion Middleware products beyond Imaging itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; authentication is required (PR:L) plus victim interaction (UI:R), which meaningfully limits mass exploitation.
Scope-changing confidentiality and integrity compromise in Oracle WebCenter Content: Imaging (Core component) affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, letting a low-privileged, network-based attacker who lures an authenticated user into an action read, create, delete, or modify all Imaging-accessible data. Oracle rates it CVSS 3.1 8.7 with a scope change, meaning successful attacks can significantly impact products beyond Imaging itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the Oracle July 2026 Critical Patch Update.
Unauthorized data access and partial data manipulation in Oracle WebCenter Content: Imaging (Fusion Middleware component: Core) lets a low-privileged, network-based attacker read all Imaging-accessible data and modify some of it over HTTP. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, with a CVSS 3.1 base score of 7.1 driven by high confidentiality and low integrity impact. No public exploit identified at time of analysis and the flaw is not on CISA KEV; the Oracle-supplied 'Authentication Bypass' tag is somewhat at odds with the CVSS PR:L requirement and should be verified against the vendor advisory.
Account/application takeover in Oracle WebCenter Content: Imaging (Core component of Fusion Middleware) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, where a remote unauthenticated attacker who lures a legitimate user into interacting with malicious content over HTTP can fully compromise the Imaging application. Oracle rates it CVSS 3.1 7.5 with high confidentiality, integrity, and availability impact, but flags it as difficult to exploit (AC:H) and dependent on user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix ships in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with network access over HTTP can take over the Imaging service, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N) yields a 7.2 base score with high confidentiality, integrity, and availability impact, meaning the attacker gains complete control of the product. No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV, though the vendor tags it under Information Disclosure.
Full compromise of Oracle WebCenter Content: Imaging (Core component) in Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker sending crafted requests over the WebLogic T3 or IIOP protocols. Successful exploitation yields complete takeover of the Imaging service with high confidentiality, integrity, and availability impact (CVSS 8.8). This was disclosed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content: Imaging (versions 12.2.1.4.0 and 14.1.2.0.0), a component of Oracle Fusion Middleware, is achievable by a low-privileged attacker with network HTTP access, per Oracle's July 2026 Critical Patch Update. Successful exploitation results in complete takeover of the Imaging component with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle WebCenter Content: Imaging (Fusion Middleware Core component) allows an unauthenticated attacker with network access via the T3 or IIOP protocols to fully compromise the product, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not yet confirmed in the wild despite the maximal severity.
Full compromise of Oracle WebCenter Content is possible in the Content Server component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a remote unauthenticated attacker reaching the server over HTTP can achieve complete takeover with full confidentiality, integrity, and availability impact. The flaw carries a CVSS 3.1 base score of 8.1, tempered by high attack complexity (AC:H) that makes reliable exploitation difficult. No public exploit identified at time of analysis, and it is not listed in CISA KEV, so risk is currently theoretical pending patch application from the Oracle July 2026 Critical Patch Update.
Privilege-abusing information disclosure and data tampering in Oracle WebCenter Content: Imaging (Core component) lets a low-privileged, network-based attacker read all Imaging-accessible data and modify some of it over HTTP. The flaw carries a scope change (CVSS 8.5), meaning a successful attack can reach beyond the Imaging module into other Fusion Middleware components, and Oracle tags it as an authentication-bypass-class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' and shipped a fix in the July 2026 Critical Patch Update.
Information disclosure and partial data tampering in the Imaging component (Core) of Oracle WebCenter Content, part of Oracle Fusion Middleware, affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with HTTP network access can compromise the Imaging service, gaining unauthorized read access to all Imaging-accessible data and limited unauthorized update, insert, or delete capability, addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis; the record carries an 'Authentication Bypass' tag despite the CVSS requiring low privileges (PR:L).
Full compromise of Oracle WebCenter Content (Content Server component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker with HTTPS network access can achieve complete takeover of the product. The CVSS 3.1 base score is 8.1 with high confidentiality, integrity, and availability impact, though the flaw is rated difficult to exploit (AC:H). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthorized data access in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets an attacker who already holds a login session on the host infrastructure read or take complete access to all data the product can reach, and because of a scope change the impact can extend to additional connected products. Addressed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.1 with confidentiality-only impact; no public exploit is identified at time of analysis and it is not listed in CISA KEV. The Oracle-supplied tag 'Authentication Bypass' suggests the flaw circumvents application-level access controls once local/infrastructure logon is obtained.
Cross-scope data compromise in Oracle WebCenter Content (Content Server component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a remote unauthenticated attacker over HTTP read, create, delete, or modify all data accessible to the Content Server, with a scope change that can significantly impact other integrated Oracle Fusion Middleware products. Oracle rates it CVSS 3.1 8.7 (high complexity) with confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor tags suggest an authentication-bypass class issue.
Sensitive data disclosure and partial data tampering in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged, network-based attacker over HTTP to gain complete read access to all data the product can reach and to modify some of that data. Oracle rates the flaw CVSS 3.1 8.5 with a scope change, meaning exploitation can significantly impact adjacent products beyond WebCenter Content itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so treat this as a high-severity but not confirmed-exploited issue.
Scope-changing data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-based attacker read, create, delete, or modify all data accessible to the application. Exploitation is rated easy but requires tricking a separate user into an interaction (UI:R), and the flaw crosses a trust boundary to significantly impact additional products (scope change). No public exploit has been identified at time of analysis and it is not on CISA KEV; EPSS was not provided.
Full remote takeover of Oracle WebCenter Content (Fusion Middleware Content Server) is possible when an unauthenticated attacker reaches the HTTP interface, per Oracle's July 2026 Critical Patch Update (CPU). The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0 and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector and Oracle 'takeover' language make it a top-priority patch.
Full compromise of Oracle WebCenter Content is possible via the Content Server component in Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0, where an attacker holding high privileges can send crafted HTTP requests to take over the product with confidentiality, integrity, and availability impact. Oracle rates the flaw CVSS 3.1 7.2 and describes it as easily exploitable once the required privilege level is held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the addressing of it in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.
Full compromise of Oracle WebCenter Content (Content Server component) allows a low-privileged, network-based attacker over HTTP to take over the application, impacting confidentiality, integrity, and availability. Affected releases are 12.2.1.4.0 and 14.1.2.0.0, and the flaw is rated CVSS 3.1 8.8 and characterized by Oracle as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.
Unauthenticated remote compromise of Oracle WebCenter Content: Imaging (component: Core) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows attackers to read and modify all data accessible to the Imaging service over HTTP. The flaw is rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, and Oracle classifies it as easily exploitable. No public exploit identified at time of analysis, and the CVE is not currently listed on CISA KEV.
Remote unauthenticated takeover of Oracle WebCenter Content: Imaging (versions 12.2.1.4.0 and 14.1.2.0.0) is possible via HTTP, per Oracle's June 2026 Critical Patch Update. With a CVSS 3.1 base score of 9.8 and AV:N/AC:L/PR:N/UI:N, the flaw in the Core component enables full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Account takeover in Oracle WebCenter Content: Imaging (Fusion Middleware) allows a low-privileged authenticated attacker with HTTP network access to fully compromise the Imaging component on versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates the flaw CVSS 8.8 with high impact across confidentiality, integrity, and availability, and describes it as 'easily exploitable.' No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 86.3%.
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.