CVE-2026-46780: Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core)

Synopsis

This is a high-severity vulnerability in the Core component of Oracle WebCenter Content: Imaging, part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with a low-privilege account can reach the vulnerable service over HTTP and exploit it without any victim interaction. Successful exploitation results in full takeover of the WebCenter Content: Imaging system, with complete loss of confidentiality, integrity, and availability. No fix version has been published by Oracle; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebCenter Content: Imaging service over the network via HTTP; local or physical access is not required but the service must be network-accessible.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative or elevated credentials, but some form of authenticated access is required.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker can exploit the vulnerability entirely on their own without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race conditions, or environment-specific factors to succeed.

Blast Radius

• A successful attacker reads all content and metadata stored in the WebCenter Content: Imaging repository, including documents, images, and associated records.
• A successful attacker modifies or deletes stored content, corrupts document workflows, and tampers with audit records held in the system.
• A successful attacker crashes or renders the WebCenter Content: Imaging service unavailable, disrupting any business processes that depend on it.
• Combined high impact across confidentiality, integrity, and availability constitutes a full system takeover as described in the CVE record.