CVE-2026-46795: Oracle WebCenter Content Auth Bypass Flaw

CVE-2026-46795 Overview

CVE-2026-46795 is an improper access control vulnerability [CWE-284] in Oracle WebCenter Content, a component of Oracle Fusion Middleware. The flaw resides in the Content Server component of version 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle WebCenter Content when a user interacts with attacker-controlled content. Successful exploitation results in unauthorized read, creation, modification, or deletion access to data within Oracle WebCenter Content. The scope-changing nature of the vulnerability means impact can extend to additional products beyond the vulnerable component.

Critical Impact
Unauthenticated network-based attacker can compromise Oracle WebCenter Content with full read and write access to critical data, with scope change extending impact to additional products.

Affected Products

Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware (Content Server component)
Deployments exposing the Content Server over HTTP to untrusted networks

Discovery Timeline

2026-06-17 - CVE-2026-46795 published to the National Vulnerability Database
2026-06-17 - Oracle Critical Patch Update advisory published
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-46795

Vulnerability Analysis

The vulnerability is classified as Improper Access Control [CWE-284] within the Content Server component of Oracle WebCenter Content. The flaw is network-exploitable over HTTP and requires no prior authentication. Exploitation requires user interaction from a victim other than the attacker, which aligns with social engineering or link-driven attack patterns.

A successful attack produces a scope change, meaning the vulnerability in Oracle WebCenter Content can affect resources managed by other components. The attacker gains unauthorized access to read, create, modify, or delete all data accessible to WebCenter Content. Availability is not directly affected, but data integrity and confidentiality are fully compromised.

Root Cause

The root cause is missing or insufficient access control enforcement in the Content Server component. Authorization checks fail to restrict actions on Content Server resources to authenticated and privileged users. The defect allows an external HTTP request, when combined with victim interaction, to perform privileged operations on stored content.

Attack Vector

The attacker delivers a crafted HTTP request or link targeting the Content Server endpoint. The victim, typically an authenticated WebCenter Content user, must interact with the attacker's payload such as visiting a URL or loading a crafted page. Once the interaction occurs, the access control gap is triggered, and the attacker performs unauthorized operations against data managed by the Content Server. No exploit code is publicly available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.383% (29.95 percentile).

No verified proof-of-concept code is publicly available. Refer to the Oracle Security Alert June 2026 for vendor technical details.

Detection Methods for CVE-2026-46795

Indicators of Compromise

Unexpected HTTP requests to Oracle WebCenter Content Server endpoints originating from external or untrusted sources
Content Server audit logs showing create, modify, or delete operations not associated with normal user workflows
Outbound requests from end-user browsers to suspicious URLs immediately preceding Content Server activity
New, modified, or deleted documents in WebCenter Content repositories outside of approved change windows

Detection Strategies

Monitor Content Server access logs for anomalous request patterns, including unauthenticated requests that trigger privileged actions
Correlate user web-browsing telemetry with Content Server administrative actions to identify interaction-driven exploitation
Alert on Content Server API calls executed without an associated authenticated session token

Monitoring Recommendations

Forward Oracle WebCenter Content audit and access logs to a centralized SIEM for retention and correlation
Baseline normal Content Server traffic volume and alert on deviations in request rate or source geography
Track changes to high-value document repositories and trigger review workflows for unexpected modifications

How to Mitigate CVE-2026-46795

Immediate Actions Required

Apply the Oracle Critical Patch Update from June 2026 to all Oracle WebCenter Content 14.1.2.0.0 deployments
Restrict network access to the Content Server to trusted internal networks and VPN clients only
Review Content Server audit logs from June 2026 onward for evidence of unauthorized data access or modification
Communicate to WebCenter Content users that they should avoid clicking unsolicited links targeting internal Oracle URLs

Patch Information

Oracle addressed CVE-2026-46795 in the June 2026 Critical Patch Update. Administrators should download and apply the patch as documented in the Oracle Security Alert June 2026. No partial mitigation should be considered a substitute for the official Oracle patch.

Workarounds

Place the Content Server behind a reverse proxy or web application firewall configured to block unauthenticated requests to sensitive endpoints
Enforce strict referrer and origin header validation on the Content Server through gateway controls
Disable or restrict any internet-facing Content Server endpoints until patching is complete

bash

# Example: restrict Content Server access at the reverse proxy layer (nginx)
location /cs/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://webcenter-content-backend;
    proxy_set_header X-Real-IP $remote_addr;
}