CVE-2026-46766: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

A critical unauthenticated remote compromise vulnerability affects Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is reachable over HTTP with no authentication or user interaction required, placing any internet- or network-exposed Content Server instance at immediate risk. Successful exploitation gives an attacker full control of the affected system, including complete read, write, and denial-of-service capability. No fix version has been published by Oracle; HarborGuard tracks the advisory for patch availability and will surface a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Content Server over the network via HTTP; any internet-exposed or internally network-accessible instance is in scope.

• AuthenticationNot required

  No account or credential of any kind is needed; the attacker can send malicious requests as an anonymous, unauthenticated user.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator of the target system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond network access.

Blast Radius

• A successful attacker reads all content managed by the Content Server, including documents, metadata, access-control lists, and stored credentials or tokens.
• The attacker writes or modifies persisted content, configuration, and administrative data within the Content Server repository.
• The attacker can crash or make the Content Server process unavailable, disrupting content delivery and dependent application workflows.
• Full system takeover means the attacker can pivot to other services reachable from the Content Server host, escalating impact beyond the initial target.