CVE-2026-46804: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

This is a cross-site scripting or similar scope-changing injection vulnerability in Oracle WebCenter Content (Content Server component, version 14.1.2.0.0). A low-privileged attacker who can reach the service over HTTP must trick another user into taking an action, at which point the attack breaks out of the originating product and affects additional systems. Successful exploitation gives the attacker full read access to critical content data and the ability to create, modify, or delete that same data. No fix version has been published by Oracle; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Content service over the network via HTTP; no local or physical access is needed.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative credentials, but must be a valid authenticated user.

• Victim interactionRequired

  A separate user (other than the attacker) must perform an action such as clicking a crafted link or loading a malicious page, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions, special memory layout, or environmental timing are required.

Blast Radius

• Reads all content and critical data accessible within Oracle WebCenter Content, including documents, records, and stored credentials or tokens surfaced by the application.
• Creates, modifies, or deletes critical content records and configuration data stored in Oracle WebCenter Content.
• The scope change (S:C) means impact extends beyond WebCenter Content itself; additional products or services that trust or consume data from the affected instance can also be compromised.