CVE-2026-46787: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

This is a network-accessible vulnerability in the Content Server component of Oracle WebCenter Content (version 14.1.2.0.0), part of Oracle Fusion Middleware. An unauthenticated remote attacker can exploit it over HTTP, but exploitation is difficult and requires a victim to interact with attacker-controlled content. Successful exploitation gives the attacker full read and write access to critical data within Oracle WebCenter Content, with a scope change meaning impact can spill into adjacent products or components. No fix version has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Content HTTP service over the network; no local or physical access is needed, but the service must be network-exposed.

• AuthenticationNot required

  No credentials are needed; the attacker can initiate the attack as an unauthenticated user.

• Victim interactionRequired

  A person other than the attacker must interact with attacker-controlled content (for example, clicking a crafted link or visiting a malicious page) for the attack to succeed.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must satisfy specific preconditions or timing constraints beyond basic network access, making reliable exploitation harder to achieve.

Blast Radius

• The attacker reads all data accessible to Oracle WebCenter Content, including documents, metadata, and stored credentials or session material managed by Content Server.
• The attacker creates, modifies, or deletes critical content records and configuration data within Oracle WebCenter Content.
• Because the CVSS scope is changed, impact can extend to other products or components that trust or consume data from the compromised Content Server instance.
• Availability is not directly impacted; the service itself remains up, but the integrity and confidentiality of its data are fully compromised.