CVE-2026-46786: CSRF
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to Oracle WebCenter Content (Content Server) HTTP interfaces to trusted IPs or internal networks using firewall rules, VPN access, or network segmentation; block unauthenticated external HTTP access.
- Compensating control
Deploy a Web Application Firewall (WAF) or HTTP request inspection in front of Oracle WebCenter Content to detect and block exploitation attempts over HTTP and to apply custom rules blocking suspicious payloads or known attack patterns.
- Operational
Monitor HTTP access logs and IDS/WAF alerts for signs of exploitation; if compromise is suspected, immediately isolate affected instances, rotate credentials and secrets used by the service, and apply any Oracle-supplied updates or patches as soon as they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46786?
The severity of CVE-2026-46786 is critical with a CVSS score of 9.6.
How do I fix CVE-2026-46786?
To fix CVE-2026-46786, apply the latest security patches provided by Oracle for the Oracle WebCenter Content version 14.1.2.0.0.
Who is affected by CVE-2026-46786?
CVE-2026-46786 affects users of Oracle WebCenter Content version 14.1.2.0.0.
What type of vulnerability is CVE-2026-46786?
CVE-2026-46786 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.
What can an attacker do with CVE-2026-46786?
An unauthenticated attacker can exploit CVE-2026-46786 to compromise Oracle WebCenter Content remotely via HTTP.