CVE-2026-46785: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

This is a critical-severity cross-scope injection or request-forgery class vulnerability in the Content Server component of Oracle WebCenter Content (version 14.1.2.0.0), reachable over HTTP with no authentication required. An unauthenticated remote attacker can exploit it by getting a user to interact with a malicious link or page, and the scope change flag means a successful attack can spill over to affect products beyond WebCenter Content itself. Exploitation gives the attacker full read access to all WebCenter Content data and the ability to create, modify, or delete critical content records. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Content Server over the network via HTTP; no local or physical access is required.

• AuthenticationNot required

  No account or credential of any kind is needed; the attacker is fully unauthenticated before exploitation begins.

• Victim interactionRequired

  A person other than the attacker must take an action (such as clicking a crafted link or visiting a malicious page) for the attack to succeed.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond victim interaction.

Blast Radius

• Reads all data accessible within Oracle WebCenter Content, including documents, metadata, and stored credentials or session material managed by the Content Server.
• Creates, modifies, or permanently deletes critical content records and document repositories within the affected WebCenter Content instance.
• Because the CVSS scope is changed, attacker influence can extend to other products or components that share the same environment or trust boundary as WebCenter Content.