CVE-2026-46791 Overview
CVE-2026-46791 is a high-severity vulnerability in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware. The flaw affects version 14.1.2.0.0 and allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation results in unauthorized access to critical data or complete access to all data accessible to Oracle WebCenter Content. The weakness maps to [CWE-284: Improper Access Control]. Oracle addressed this issue in its Oracle Security Alert June 2026.
Critical Impact
An unauthenticated remote attacker can read all data accessible to Oracle WebCenter Content over HTTP without user interaction.
Affected Products
- Oracle WebCenter Content 14.1.2.0.0
- Oracle Fusion Middleware (Content Server component)
- Deployments exposing the Content Server HTTP interface to untrusted networks
Discovery Timeline
- 2026-06-17 - CVE-2026-46791 published to NVD
- 2026-06-17 - Last updated in NVD database
- June 2026 - Oracle releases fix in the Critical Patch Update / Security Alert advisory
Technical Details for CVE-2026-46791
Vulnerability Analysis
The vulnerability resides in the Content Server component of Oracle WebCenter Content. Oracle classifies the issue as easily exploitable over HTTP with no privileges and no user interaction required. The impact is restricted to confidentiality, but the scope covers all data accessible to the Content Server, including documents managed by the repository. Integrity and availability are not affected, which aligns with a read-oriented access control failure rather than a code execution or denial-of-service condition. The EPSS score at publication is 0.414% (percentile 32.95), indicating no observed exploitation activity at this time.
Root Cause
The issue is categorized under [CWE-284: Improper Access Control]. Oracle's advisory describes the defect as allowing unauthenticated network attackers to reach protected data through the Content Server interface. Public technical details have not been released by Oracle, consistent with its standard Critical Patch Update disclosure practice.
Attack Vector
An attacker reaches the Content Server over the network using HTTP. No authentication, credentials, or user interaction are needed. Once the request is processed, the attacker can retrieve content that should require authorization. Internet-exposed WebCenter Content instances are the highest-risk deployments, followed by intranet-reachable installations that handle sensitive enterprise documents. Verified proof-of-concept code is not publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified exploit code is available. See the Oracle Security Alert June 2026 for vendor guidance.
Detection Methods for CVE-2026-46791
Indicators of Compromise
- Unauthenticated HTTP or HTTPS requests to Content Server endpoints (commonly under /cs/ or /_dav/) returning document payloads or metadata.
- Spikes in GetFile, GET_SEARCH_RESULTS, or similar Content Server service requests originating from a single external IP.
- Access log entries showing successful 200 responses to document retrieval calls without an associated authenticated session.
Detection Strategies
- Review Oracle WebCenter Content access logs and the Content Server audit trail for anonymous service calls that return content.
- Inspect web application firewall and reverse proxy logs for HTTP requests to WebCenter Content URIs lacking session cookies or Authorization headers.
- Correlate outbound data volume from the Content Server host with the source IPs issuing unauthenticated requests.
Monitoring Recommendations
- Forward Content Server, WebLogic, and HTTP server logs to a centralized SIEM for retention and analysis.
- Alert on bursts of document retrieval requests originating from IPs that have never authenticated to the application.
- Track patch state of all Oracle Fusion Middleware hosts against the June 2026 Critical Patch Update inventory.
How to Mitigate CVE-2026-46791
Immediate Actions Required
- Apply the patch from the Oracle Security Alert June 2026 to all Oracle WebCenter Content 14.1.2.0.0 instances.
- Inventory exposed WebCenter Content deployments and restrict the Content Server HTTP interface to trusted networks until patching is complete.
- Review access and audit logs for unauthenticated document retrieval since the patch became available.
Patch Information
Oracle released the fix as part of its June 2026 Critical Patch Update / Security Alert cycle. Administrators should download the corresponding bundle for Oracle WebCenter Content 14.1.2.0.0 from My Oracle Support and follow Oracle's documented application procedure for Fusion Middleware. No supported workaround is published; the patch is the vendor-recommended remediation.
Workarounds
- Place the Content Server behind an authenticating reverse proxy or VPN to block anonymous HTTP access.
- Use network ACLs or WAF rules to deny external requests to WebCenter Content URIs from untrusted source ranges.
- Disable or filter unauthenticated Content Server services where business workflows allow, pending patch deployment.
# Example: restrict access to Oracle WebCenter Content Server with iptables
iptables -A INPUT -p tcp --dport 16200 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 16200 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
