CVE-2026-46783: Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core)

Synopsis

An unauthenticated remote compromise vulnerability affects Oracle WebCenter Content: Imaging (Core component) in versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is reachable over HTTP from any network location and requires no credentials or user interaction to exploit. Successful exploitation gives an attacker full control of the affected system, including the ability to read, modify, or destroy data and disrupt service availability. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as Oracle ships an upstream fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebCenter Content: Imaging service over the network via HTTP; there is no requirement for local or physical access.

• AuthenticationNot required

  No credentials of any kind are needed; the attack is fully unauthenticated.

• Victim interactionNot required

  No user or administrator action is required to trigger the vulnerability; the attacker operates entirely without victim involvement.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special pre-conditions, race conditions, or environmental requirements on the attacker.

Blast Radius

• A successful attacker gains full read access to all content managed by WebCenter Content: Imaging, including stored documents, metadata, and any credentials or tokens held in the application.
• The attacker can modify or delete persisted documents, index records, and configuration data, corrupting the integrity of the content repository.
• The attacker can crash or render the WebCenter Content: Imaging service completely unavailable, disrupting any workflows or business processes that depend on it.
• Because the CVE description characterizes the outcome as full system takeover, the attacker also gains the ability to execute arbitrary operations under the identity of the application process, potentially pivoting to other systems on the same host or network segment.