CVE-2026-46791

Unauthenticated Data Exposure via HTTP in Oracle WebCenter Content

Published Jun 16, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Analysis

Technical impact

A remote unauthenticated vulnerability exists in Oracle WebCenter Content (component: Content Server) that can be exploited over HTTP. Successful exploitation enables an attacker to read critical data and potentially gain unrestricted access to all data accessible through the WebCenter Content platform, resulting in a severe confidentiality compromise. The weakness arises from improper input validation and authorization controls that allow requests to retrieve protected content without authentication.

Affected Systems

Oracle WebCenter Content version 14.1.2.0.0 is affected. The vulnerability applies to the Oracle Fusion Middleware stack that includes the Content Server component.

Risk and Exploitability

The CVSS 3.1 score of 7.5 indicates a high severity impact with a high confidentiality impact, while the EPSS score of less than 1% signals that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via an unauthenticated HTTP request to the WebCenter Content service, taking advantage of improper authorization checks.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle WebCenter Content

affected

Version	Status	Constraints
`14.1.2.0.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:oracle:webcenter_content:14.1.2.0.0:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Webcenter Content

Version	Status	Scheme	Platform
`14.1.2.0.0`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Verify and apply any Oracle security patch or update for WebCenter Content 14.1.2.0.0; if a patch is not yet available, upgrade to a newer, supported release once available.
Enforce strict access control policies in WebCenter Content to ensure that only authenticated users can retrieve protected content, mitigating the authorization weakness.
Restrict network access to WebCenter Content by configuring firewalls or access control lists to allow only trusted IP ranges, and disable unnecessary HTTP endpoints.
Enable logging and monitoring for the Content Server to detect anomalous access patterns, and review logs regularly for signs of unsuccessful exploitation attempts.

Generated by OpenCVE AI on June 18, 2026 at 23:49 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.414% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.oracle.com/security-alerts/cspujun2026.html

History

Jun 19, 2026 12:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		Unauthenticated Data Exposure via HTTP in Oracle WebCenter Content

Jun 18, 2026 10:15 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Unauthenticated HTTP Exploit Grants Unauthorized Data Access in Oracle WebCenter Content
Weaknesses	CWE-285

Jun 18, 2026 4:45 AM Title updated. Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		Unauthenticated HTTP Exploit Grants Unauthorized Data Access in Oracle WebCenter Content
Weaknesses		CWE-284 CWE-285
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 16, 2026 8:45 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared		Oracle Oracle webcenter Content
CPEs		cpe:2.3:a:oracle:webcenter_content:14.1.2.0.0:::::::*
Vendors & Products		Oracle Oracle webcenter Content
References		https://www.oracle.com/security-alerts/cspujun2026.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`