CVE-2026-46786: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

A critical unauthenticated remote attack vulnerability exists in Oracle WebCenter Content (Content Server component, version 14.1.2.0.0). The vulnerability is reachable over the network via HTTP with no credentials required, though a victim must interact for the attack to succeed. Successful exploitation results in full takeover of the Oracle WebCenter Content instance, with impact extending beyond the directly targeted product to other systems in scope. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Content service over the network via HTTP; no local or physical access is assumed.

• AuthenticationNot required

  No credentials of any kind are needed; the attacker can interact with the service as an anonymous user.

• Victim interactionRequired

  A person other than the attacker must take some action (such as clicking a link or visiting a crafted page) for the attack to complete.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and repeatable with no dependency on race conditions or specific environmental states.

Blast Radius

• A successful attacker reads all content managed by the Content Server, including documents, stored credentials, and session data.
• The attacker modifies or deletes persisted content, configurations, and access control records within the WebCenter Content repository.
• The Content Server process is crashed or made unavailable, disrupting document management and dependent workflows.
• Because scope changes, the attacker can pivot to compromise other products and services that trust or integrate with the affected Oracle WebCenter Content instance.