CVE-2026-46777: Critical severity Oracle Oracle WebCenter Content vulnerability
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable direct HTTP access to the Content Server where possible, or restrict HTTP access to trusted management networks only (for example, require VPN or put behind an authenticated reverse proxy/WAF).
Oracle WebCenter Content (Content Server) HTTP access = disabled or restricted to trusted networks - Compensating control
Restrict access to Oracle WebCenter Content HTTP endpoints at the network perimeter using firewall rules or ACLs to allow only trusted IP ranges and management hosts.
- Compensating control
Deploy a Web Application Firewall (WAF) or virtual patching to block exploit attempts targeting Oracle WebCenter Content and create monitoring rules/signatures for suspicious requests.
- Compensating control
Isolate affected instances from untrusted networks until a vendor patch or other permanent remediation is available (network segmentation/quarantine).
- Operational
Review audit and access logs for signs of unauthorized creation, deletion, modification, or access to content; investigate any anomalies and preserve forensic evidence.
- Operational
If compromise is suspected, restore impacted content from known-good backups and rotate any credentials, API keys, or secrets that may have been exposed or used by the attacker.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46777?
The severity of CVE-2026-46777 is critical, with a CVSS score of 9.1.
How do I fix CVE-2026-46777?
To fix CVE-2026-46777, apply the latest patches provided by Oracle for the affected versions.
Who is affected by CVE-2026-46777?
Oracle WebCenter Content users running versions 12.2.1.4.0 and 14.1.2.0.0 are affected by CVE-2026-46777.
What type of vulnerability is CVE-2026-46777?
CVE-2026-46777 is a remotely exploitable vulnerability that allows unauthenticated access via HTTP.
What can an attacker do with CVE-2026-46777?
An attacker can potentially compromise Oracle WebCenter Content due to CVE-2026-46777.