CVE-2026-46784: WebCenter Content Auth Bypass Flaw

CVE-2026-46784 Overview

CVE-2026-46784 is an access control vulnerability [CWE-284] in the Oracle WebCenter Content: Imaging product, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0 in the Core component. An unauthenticated attacker with network access via HTTP can exploit this issue without user interaction. Successful exploitation grants unauthorized read, create, modify, and delete access to all WebCenter Content: Imaging accessible data.

Critical Impact
Remote unauthenticated attackers can compromise confidentiality and integrity of all data managed by Oracle WebCenter Content: Imaging over the network.

Affected Products

Oracle Fusion Middleware WebCenter Content: Imaging 12.2.1.4.0
Oracle Fusion Middleware WebCenter Content: Imaging 14.1.2.0.0
Core component of WebCenter Content: Imaging

Discovery Timeline

2026-06-17 - CVE-2026-46784 published to NVD
2026-06-17 - Last updated in NVD database
2026-06-18 - EPSS score recorded at 0.404%

Technical Details for CVE-2026-46784

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebCenter Content: Imaging, a document and content management module within Oracle Fusion Middleware. Oracle classifies the issue as easily exploitable. A remote attacker can interact with the affected HTTP-facing interface without authentication and without user interaction. The impact extends to all data accessible to the WebCenter Content: Imaging application, including creation, deletion, and modification of records as well as full read access. Availability is not directly impacted. The Common Weakness Enumeration assigns this issue to [CWE-284] Improper Access Control. The Exploit Prediction Scoring System places this CVE in the 32.1 percentile with a probability of 0.404%, indicating elevated but not widespread exploitation likelihood at publication time.

Root Cause

The underlying defect is improper enforcement of access control on HTTP requests reaching the WebCenter Content: Imaging Core. Operations that should require authentication and authorization are reachable by anonymous network clients. This permits an attacker to invoke privileged content operations without presenting valid credentials.

Attack Vector

Exploitation occurs over the network using HTTP requests directed at the WebCenter Content: Imaging endpoint. The attack requires no privileges, no user interaction, and low attack complexity. Public proof-of-concept exploit code has not been observed at the time of publication. Refer to the Oracle Security Alert for vendor technical details.

Detection Methods for CVE-2026-46784

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to WebCenter Content: Imaging endpoints performing create, read, update, or delete operations on imaging records.
Anomalous spikes in document or content modification events without an associated authenticated session identifier.
Outbound HTTP traffic from WebCenter Content: Imaging hosts to unfamiliar destinations following inbound anonymous activity.

Detection Strategies

Inspect WebCenter Content: Imaging access logs for HTTP requests to imaging URIs that lack authentication headers or session tokens yet succeed.
Compare request patterns against baseline behavior for the Core component and alert on unauthenticated access to administrative or content modification paths.
Correlate Oracle Fusion Middleware audit events with web server logs to identify privileged actions without a preceding successful login.

Monitoring Recommendations

Enable detailed audit logging for WebCenter Content: Imaging and forward events to a centralized SIEM or data lake for retention and correlation.
Monitor file and metadata changes within Imaging repositories for unauthorized modification, deletion, or mass export.
Track HTTP error and success ratios on Imaging endpoints to detect enumeration or scanning activity targeting 12.2.1.4.0 and 14.1.2.0.0 deployments.

How to Mitigate CVE-2026-46784

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to all affected WebCenter Content: Imaging instances.
Restrict network access to WebCenter Content: Imaging HTTP endpoints to trusted management networks until patching is complete.
Audit existing Imaging content for unauthorized creation, modification, or deletion events since the affected versions were deployed.

Patch Information

Oracle has published fixes through its Critical Patch Update process. Administrators should consult the Oracle Security Alert for the specific patch identifiers and installation procedures applicable to Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0.

Workarounds

Place WebCenter Content: Imaging behind a reverse proxy or web application firewall that enforces authentication before requests reach the Core component.
Disable or block the Imaging HTTP endpoints if the module is not actively used in the deployment.
Limit inbound HTTP access to the application server using network access control lists scoped to known administrative source addresses.

bash

# Example firewall restriction limiting access to the Imaging HTTP port
# Replace 10.0.0.0/24 with your trusted administrative network
iptables -A INPUT -p tcp --dport 16000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 16000 -j DROP