CVE-2026-46813: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

An unauthenticated remote code execution (full system takeover) vulnerability affects Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0, specifically the Content Server component. The flaw is reachable over HTTP without any credentials or user interaction, making it trivially exploitable by any attacker who can reach the service on the network. Successful exploitation gives an attacker complete control over the affected instance, covering confidentiality, integrity, and availability. No fix version has been published by Oracle; HarborGuard is actively tracking this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Content Server over the network via HTTP; no local access or special positioning is required.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerable endpoint is exposed to unauthenticated requests.

• Victim interactionNot required

  The attack is fully automated and requires no action from any user of the target system.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory-layout guessing, or environmental preconditions are required.

Blast Radius

• A successful attacker gains full read access to all content managed by the Content Server, including stored documents, metadata, and access credentials cached by the application.
• An attacker can write, modify, or delete any content or configuration data within the Oracle WebCenter Content instance.
• The attacker achieves complete process-level control, enabling arbitrary command execution on the underlying host and lateral movement to connected systems.
• The service can be crashed or rendered unavailable, disrupting any business workflows that depend on the Content Server for document management or publishing.