CVE-2026-46795: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

This is a critical-severity cross-scope injection or content-tampering vulnerability in the Content Server component of Oracle WebCenter Content (version 14.1.2.0.0), part of Oracle Fusion Middleware. An unauthenticated attacker reachable over HTTP can exploit it by tricking a user into interacting with a malicious link or page, with no credentials required on the attacker's side. Successful exploitation gives the attacker full read access to all WebCenter Content data and the ability to create, modify, or delete critical content, with impact that can extend beyond the directly targeted product instance. No fix version has been published yet; HarborGuard tracks this advisory and will surface patch availability the moment Oracle ships a corrected release.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Content Server over the network via HTTP; there is no requirement for local or physical access.

• AuthenticationNot required

  No credentials of any kind are needed; the attacker can initiate the attack as a completely anonymous network user.

• Victim interactionRequired

  A person other than the attacker must perform some interaction (such as clicking a crafted link or visiting a malicious page) for the exploit to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special preconditions, race conditions, or environmental setup beyond reaching the service.

Blast Radius

• Reads all data accessible within Oracle WebCenter Content, including documents, records, and stored credentials or tokens managed by the content repository.
• Creates, modifies, or deletes critical content objects within the repository, enabling persistent data corruption or destruction of records.
• Because the CVSS scope is changed, impact can propagate to other products or components that rely on or trust data served by the WebCenter Content instance.