CVE-2026-46806: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

This is a cross-site scripting or similar client-side injection vulnerability (scope-changing, unauthenticated) in Oracle WebCenter Content version 14.1.2.0.0, specifically in the Content Server component. It is reachable over the network via HTTPS without any authentication, but requires a victim to interact with attacker-controlled content, and it carries a changed scope meaning successful exploitation affects resources beyond the vulnerable component itself. A successful attack gives the attacker read access to all data accessible to Oracle WebCenter Content and limited write access (insert, update, delete) to some of that data. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Content Server over the network via HTTPS; no local or physical access is required.

• AuthenticationNot required

  No account or credentials are needed; the attacker can engage the vulnerable endpoint as a completely anonymous user.

• Victim interactionRequired

  A person other than the attacker must interact with attacker-supplied content (for example, visiting a crafted link or page) for the attack to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental configuration.

Blast Radius

• The attacker reads all data accessible to the Oracle WebCenter Content instance, including documents, metadata, and stored content that may contain sensitive business or personal information.
• The attacker performs unauthorized insert, update, or delete operations against a subset of Oracle WebCenter Content data, allowing tampering with stored records or documents.
• Because the CVSS scope is changed, the impact can extend beyond Oracle WebCenter Content itself to other products or services that share the same session context or trust boundary.