CVE-2026-46805: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

This is a critical-severity unauthenticated attack against the Content Server component of Oracle WebCenter Content (version 14.1.2.0.0), reachable over the network via HTTP. The attack requires a victim to take some action (such as clicking a malicious link), but no credentials are needed from the attacker's side. Successful exploitation gives an attacker full read access to all content the server can reach and the ability to create, modify, or delete that same data, with a scope change meaning the impact can spill into other products beyond WebCenter Content itself. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Content Server over the network via HTTP; no local or physical access is needed (AV:N).

• AuthenticationNot required

  No credentials of any privilege level are required; the attacker starts the attack as an anonymous network caller (PR:N).

• Victim interactionRequired

  A person other than the attacker must take some action, such as clicking a crafted link or visiting a malicious page, for the attack to succeed (UI:R).

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or special environmental setup required (AC:L).

Blast Radius

• A successful attacker reads all data accessible to the Content Server, including stored documents, metadata, and user records.
• The attacker can create, overwrite, or delete any content the server manages, corrupting document repositories and audit trails.
• Because the CVSS scope is changed (S:C), the attacker's reach extends beyond WebCenter Content itself and can affect other products or services sharing the same environment.