CVE-2026-46784: Critical severity Oracle WebCenter Content: Imaging vulnerability
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebCenter Content: Imaging. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all WebCenter Content: Imaging accessible data as well as unauthorized access to critical data or complete access to all WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Oracle WebCenter Content: Imagingfrom your environment.Uninstall or remove WebCenter Content: Imaging instances that are not required to eliminate exposure.
- Configuration
Disable or stop exposing the HTTP listener to untrusted networks (bind to internal interfaces or disable the listener) or require access only via a secure reverse proxy that enforces authentication and access controls.
WebCenter Content: Imaging (HTTP interface) HTTP access = disabled or restricted to internal/trusted networks - Compensating control
Restrict network access to the WebCenter Content: Imaging HTTP interface to only trusted management IPs (firewall/ACL) and block public internet access to the application endpoints, since the vulnerability is exploitable via HTTP by unauthenticated attackers.
- Compensating control
Place a Web Application Firewall (WAF) or equivalent HTTP inspection in front of the WebCenter Content: Imaging HTTP endpoints to detect and block exploitation attempts until an official vendor fix is applied.
- Operational
If there is any suspicion of compromise, perform incident response actions: review and preserve logs, audit for unauthorized creation/deletion/modification, restore impacted data from known-good backups, and rotate any credentials or secrets that may have been exposed.
- Operational
Monitor Oracle security advisories for an official patch or fixed release for WebCenter Content: Imaging and plan to apply vendor-provided fixes as soon as they are published.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46784?
CVE-2026-46784 has a severity rating of 9.1, classifying it as critical.
How do I fix CVE-2026-46784?
To fix CVE-2026-46784, apply the security patches provided by Oracle for the affected versions of WebCenter Content.
Who is affected by CVE-2026-46784?
CVE-2026-46784 affects users of Oracle WebCenter Content and Oracle WebCenter Content: Imaging, specifically version 12.2.1.4.0 and 14.1.2.0.0.
What type of access is required to exploit CVE-2026-46784?
CVE-2026-46784 can be exploited by an unauthenticated attacker with network access via HTTP.
What are the potential impacts of CVE-2026-46784?
The potential impacts of CVE-2026-46784 include unauthorized access to sensitive content and possible compromise of the WebCenter Content application.