CVE-2026-46787: Oracle WebCenter Content CSRF Vulnerability

CVE-2026-46787 Overview

CVE-2026-46787 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware. The flaw affects version 14.1.2.0.0 and allows an unauthenticated attacker with network access via HTTP to compromise the application. Exploitation requires user interaction from a victim other than the attacker. Successful attacks can cross trust boundaries (scope change) and impact additional products beyond Oracle WebCenter Content itself. The attacker can gain unauthorized read, create, modify, or delete access to all data accessible through Oracle WebCenter Content.

Critical Impact
Successful exploitation enables unauthorized read and write access to all data accessible by Oracle WebCenter Content, with potential impact extending to additional connected products through scope change.

Affected Products

Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware (Content Server component)
Downstream systems integrated with affected WebCenter Content deployments

Discovery Timeline

2026-06-17 - CVE-2026-46787 published to the National Vulnerability Database
2026-06-17 - Oracle publishes the Oracle Security Alert
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-46787

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery weakness in the Content Server component of Oracle WebCenter Content. The application does not sufficiently validate that authenticated state-changing requests originated from a legitimate user action. An attacker can craft a malicious web page or message that causes a victim's browser to issue forged requests to a WebCenter Content instance the victim is authenticated to.

The attack carries a scope change, meaning the security impact extends beyond the WebCenter Content component itself to other products and integrations that trust the Content Server. The EPSS score is 0.16% at the time of publication, reflecting the high attack complexity and user interaction requirement.

Root Cause

The root cause is missing or insufficient anti-CSRF protections on sensitive HTTP endpoints within the Content Server. The component fails to enforce origin validation or per-session, unpredictable request tokens for state-changing operations. As a result, the server cannot distinguish between legitimate user-initiated requests and forged cross-site requests submitted by the victim's authenticated browser.

Attack Vector

The attacker hosts or delivers content containing crafted HTML, JavaScript, or form payloads that target Oracle WebCenter Content endpoints. The victim, who holds an authenticated session with the vulnerable WebCenter Content instance, must interact with the attacker-controlled content. The victim's browser then issues authenticated requests to the Content Server. Successful exploitation enables data creation, modification, deletion, or disclosure under the victim's privileges, and may pivot into adjacent products due to the scope change. See the Oracle Security Alert for vendor-supplied technical details.

Detection Methods for CVE-2026-46787

Indicators of Compromise

HTTP referer or origin headers on Content Server requests that point to untrusted external domains.
Authenticated state-changing requests to WebCenter Content endpoints lacking expected anti-CSRF token parameters.
Unexpected content creation, modification, or deletion events tied to user sessions immediately following external browsing activity.
Bursts of identical authenticated POST or PUT requests originating from a single user session.

Detection Strategies

Inspect web application firewall and reverse proxy logs for cross-origin requests targeting Content Server URLs.
Correlate Content Server audit logs with proxy logs to flag state-changing actions whose Referer or Origin headers fall outside approved domains.
Alert on Content Server administrative or document-management actions performed without a valid anti-CSRF token.

Monitoring Recommendations

Forward Oracle WebCenter Content audit logs, web server access logs, and WAF telemetry to a centralized analytics platform for correlation.
Baseline normal user document workflows and alert on deviations such as bulk deletions or permission changes initiated from unusual referers.
Monitor browser-side telemetry from endpoint protection tools for navigation to suspicious sites immediately preceding WebCenter Content write activity.

How to Mitigate CVE-2026-46787

Immediate Actions Required

Apply the Oracle Critical Patch Update for June 2026 to all Oracle WebCenter Content 14.1.2.0.0 instances as documented in the Oracle Security Alert.
Inventory all Oracle Fusion Middleware deployments and confirm Content Server version exposure.
Restrict Content Server administrative interfaces to trusted networks and VPN-protected access where feasible.
Educate privileged WebCenter Content users to avoid clicking untrusted links while authenticated to the application.

Patch Information

Oracle addresses CVE-2026-46787 in the June 2026 Critical Patch Update. Administrators must download and apply the patch documented at the Oracle Security Alert. Validate the patched version after installation and review Oracle's post-installation configuration guidance to ensure CSRF protections are enabled.

Workarounds

Enforce SameSite=Strict or SameSite=Lax cookie attributes on Content Server session cookies through reverse proxy configuration where supported.
Deploy a web application firewall rule that blocks Content Server state-changing requests whose Origin or Referer headers do not match approved hostnames.
Reduce session lifetime for privileged WebCenter Content accounts to shrink the window in which a CSRF attack can succeed.
Require re-authentication for sensitive administrative operations within the Content Server.

bash

# Example reverse proxy rule enforcing Origin validation for Content Server
# Reject state-changing requests that do not originate from approved hosts
location /cs/ {
    if ($request_method ~ ^(POST|PUT|DELETE|PATCH)$) {
        set $csrf_block "1";
    }
    if ($http_origin ~* ^https?://(webcenter\.example\.com)$) {
        set $csrf_block "0";
    }
    if ($csrf_block = "1") {
        return 403;
    }
    proxy_pass http://webcenter_backend;
}