CVE-2026-46785: Oracle WebCenter Content CSRF Vulnerability

CVE-2026-46785 Overview

CVE-2026-46785 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware. The flaw affects version 14.1.2.0.0 and allows an unauthenticated attacker with network access over HTTP to compromise the product when a victim user is tricked into interacting with attacker-controlled content. Successful exploitation results in unauthorized creation, deletion, or modification of data and unauthorized read access to all data accessible by Oracle WebCenter Content. The vulnerability carries a scope change, meaning impact extends beyond the vulnerable component to additional products.

Critical Impact
An unauthenticated remote attacker can compromise confidentiality and integrity of all WebCenter Content data through a single user interaction, with impact spreading to connected products via scope change.

Affected Products

Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware (Content Server component)
Downstream Oracle products integrated with WebCenter Content (scope change)

Discovery Timeline

2026-06-17 - CVE-2026-46785 published to NVD
2026-06-17 - Oracle Critical Patch Update advisory released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-46785

Vulnerability Analysis

The vulnerability resides in the Content Server component of Oracle WebCenter Content, which handles document management, web content, and digital asset operations. The component fails to validate the origin or intent of state-changing HTTP requests, allowing forged requests to execute under an authenticated victim's session. Because the flaw triggers a scope change, exploitation can affect resources outside Oracle WebCenter Content itself, including integrated Fusion Middleware services.

Attacks require human interaction from a user other than the attacker, typically through visiting a malicious page or clicking a crafted link while authenticated to WebCenter Content. Once triggered, the attacker can read, modify, create, or delete data the victim has access to. Availability is not impacted, but confidentiality and integrity impacts are rated high.

Root Cause

The root cause is missing or insufficient CSRF protection [CWE-352] on sensitive Content Server endpoints. Browsers automatically attach session cookies to cross-origin requests, and without anti-CSRF tokens, SameSite cookie enforcement, or origin validation, the server processes forged requests as legitimate user actions.

Attack Vector

An attacker hosts a malicious web page or sends a crafted link to a victim with an active Oracle WebCenter Content session. When the victim loads the page, the browser issues HTTP requests to the WebCenter Content server containing the victim's session cookies. The server executes the requested operations, granting the attacker the victim's privileges over content stored in the platform.

No authenticated code or PoC is publicly available. Detailed technical specifics remain limited to Oracle's coordinated disclosure. See the Oracle Security Alert for vendor-supplied details.

Detection Methods for CVE-2026-46785

Indicators of Compromise

Unexpected content modifications, deletions, or new document uploads attributed to legitimate user accounts without corresponding user activity in session logs.
HTTP requests to Content Server endpoints carrying Referer or Origin headers from untrusted external domains.
Outbound user navigation to suspicious URLs followed immediately by state-changing Content Server requests in access logs.

Detection Strategies

Correlate Content Server audit logs with web proxy logs to identify state-changing operations preceded by cross-origin navigation.
Alert on POST or PUT requests to WebCenter Content endpoints missing expected anti-CSRF tokens or with mismatched Origin headers.
Monitor for bulk content operations performed within seconds of a user clicking external links delivered via email or chat.

Monitoring Recommendations

Ingest Oracle WebCenter Content access and audit logs into a centralized SIEM with OCSF normalization for cross-source correlation.
Establish behavioral baselines for content creation and deletion rates per user, alerting on deviations.
Track user-agent strings and source IP geolocation for sessions performing administrative actions.

How to Mitigate CVE-2026-46785

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert for the June 2026 cycle.
Inventory all Oracle WebCenter Content 14.1.2.0.0 instances and prioritize internet-exposed deployments for immediate patching.
Force re-authentication for all active WebCenter Content sessions following patch deployment.

Patch Information

Oracle has released a fix as part of the June 2026 Critical Security Patch Update. Administrators should review the Oracle Security Alert for patch identifiers, prerequisites, and installation procedures applicable to version 14.1.2.0.0 of Oracle WebCenter Content.

Workarounds

Restrict access to the Content Server interface to trusted networks or VPN clients until patching is complete.
Configure session cookies with SameSite=Strict or SameSite=Lax at the reverse proxy or web tier to limit cross-origin cookie transmission.
Train privileged WebCenter Content users to log out after sessions and avoid following untrusted links while authenticated.
Deploy a web application firewall rule to block state-changing requests lacking matching Origin or Referer headers from the WebCenter Content domain.

bash

# Example reverse proxy hardening for SameSite cookie enforcement
# nginx configuration snippet
proxy_cookie_path / "/; SameSite=Strict; Secure; HttpOnly";
add_header Content-Security-Policy "frame-ancestors 'self'";