CVE-2026-46789

Unauthenticated remote takeover via HTTP in Oracle WebCenter Content 14.1.2

Published Jun 16, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

Analysis

Technical impact

This vulnerability exists in Oracle WebCenter Content 14.1.2.0.0 and allows an unauthenticated attacker who can reach the server over HTTP to compromise the system. The flaw is exploitable with low attack complexity, and it requires a user interaction that is not performed by the attacker. Once exploited, the attacker can take full control of the application, exposing confidential data, tampering with stored content, and disrupting its availability. The weakness is an improper access control that exposes the system to unauthorized takeover.

Affected Systems

Oracle WebCenter Content version 14.1.2.0.0.

Risk and Exploitability

The CVSS v3.1 Base Score of 9.6 indicates a critical impact to confidentiality, integrity, and availability. The EPSS score of less than 1% reflects a very low but nonzero probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is HTTP over the network, but successful exploitation requires additional human interaction that is not in the attacker's direct control, reducing the probability of automated attacks yet leaving the high impact if the conditions are met.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle WebCenter Content

affected

Version	Status	Constraints
`14.1.2.0.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:oracle:webcenter_content:14.1.2.0.0:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Webcenter Content

Version	Status	Scheme	Platform
`14.1.2.0.0`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Oracle patch for WebCenter Content 14.1.2.0.0 from the Oracle Support portal.
Restrict HTTP access to the WebCenter Content server to trusted IP ranges or through a VPN to limit the attack surface.
If a patch cannot be applied immediately, enforce network segmentation and monitor HTTP traffic for anomalous request patterns that may indicate exploitation attempts.

Generated by OpenCVE AI on June 18, 2026 at 23:25 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.416% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.oracle.com/security-alerts/cspujun2026.html

History

Jun 18, 2026 11:45 PM Title updated View changes

Type	Values Removed	Values Added
Title		Unauthenticated remote takeover via HTTP in Oracle WebCenter Content 14.1.2

Jun 18, 2026 10:30 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Unauthenticated Remote Takeover via HTTP in Oracle WebCenter Content
Weaknesses	CWE-284

Jun 18, 2026 4:45 AM Title updated. Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		Unauthenticated Remote Takeover via HTTP in Oracle WebCenter Content
Weaknesses		CWE-284 CWE-306
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 16, 2026 8:45 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
First Time appeared		Oracle Oracle webcenter Content
CPEs		cpe:2.3:a:oracle:webcenter_content:14.1.2.0.0:::::::*
Vendors & Products		Oracle Oracle webcenter Content
References		https://www.oracle.com/security-alerts/cspujun2026.html
Metrics		cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}`