CVE-2026-46777: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

An unauthenticated remote vulnerability affects Oracle WebCenter Content (Content Server component), versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is reachable over HTTP from any network without credentials or user interaction, making it trivially exploitable at scale. Successful exploitation gives an attacker full read access to all content managed by the server and the ability to create, modify, or delete critical data. No fix version has been published by Oracle; HarborGuard tracks the advisory and will surface a patched rebuild the moment upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Content Server over the network via HTTP; no local or physical access is required, and there is no network-segment restriction.

• AuthenticationNot required

  No credentials or existing account are needed; the vulnerability is exploitable by any unauthenticated caller.

• Victim interactionNot required

  No user action is needed on the target system; the attacker drives the exploit entirely without social engineering.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and imposes no special conditions, race requirements, or environmental dependencies.

Blast Radius

• Reads all content assets, documents, and metadata stored in Oracle WebCenter Content, including items classified as critical data.
• Creates new content records or uploads arbitrary files into the Content Server repository.
• Modifies or deletes existing content, metadata, and access-control records across the entire repository.
• Because availability impact is rated None, the service itself stays running, meaning a persistent attacker can continue data access and manipulation without triggering an outage-based alert.