CVE-2026-46791: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

An unauthenticated information-disclosure vulnerability exists in the Content Server component of Oracle WebCenter Content (version 14.1.2.0.0), part of Oracle Fusion Middleware. The flaw is reachable over the network via HTTP and requires no credentials or user interaction to exploit. Successful exploitation gives an attacker full read access to all data the Content Server can access, including potentially sensitive documents and records. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Content Server over the network via HTTP; no local or physical access is required.

• AuthenticationNot required

  No credentials are needed; an unauthenticated attacker can trigger the vulnerability directly.

• Victim interactionNot required

  The attack is fully server-side and succeeds without any action from a user or administrator.

• Attack complexityDetail

  Exploit complexity is low, meaning the attack is reliable and requires no special conditions, race timing, or environmental factors to succeed.

Blast Radius

• Reads any document, record, or file stored in or accessible by the Oracle WebCenter Content repository.
• Reads user account data, metadata, and access-control configurations exposed through the Content Server.
• Enables an attacker to map the full corpus of managed content, which can serve as a stepping stone for targeted follow-on attacks using harvested data.