CVE-2026-46788: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

A high-severity vulnerability affects the Content Server component of Oracle WebCenter Content (version 14.1.2.0.0), part of Oracle Fusion Middleware. The flaw is reachable over the network via HTTP and requires an attacker to hold an administrative or high-privileged account, plus a separate user to interact with a crafted request or resource. Successful exploitation results in full takeover of Oracle WebCenter Content, including complete read, write, and availability impact that extends beyond the directly affected product due to a scope change. No fix version has been published yet; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Content Server over the network via HTTP; no local or physical access is required.

• AuthenticationRequired

  A high-privileged (administrative) account on the target system is needed before the attack can proceed.

• Victim interactionRequired

  A separate, non-attacker user must interact with attacker-supplied content (for example, by visiting a crafted URL or opening a malicious resource) for the attack to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• A successful attacker reads all content, documents, and metadata stored in Oracle WebCenter Content, including any confidential records managed by the Content Server.
• The attacker can modify or delete persisted content items, repository metadata, and configuration data within the Content Server.
• The Content Server process can be crashed or made unavailable, disrupting document management and publishing workflows that depend on it.
• Because the CVSS scope is changed, the impact can extend to other products or services sharing the same host or integration layer beyond the directly targeted Oracle WebCenter Content instance.