CVE-2026-46805: Oracle WebCenter Content Auth Bypass Flaw

CVE-2026-46805 Overview

CVE-2026-46805 is a critical vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware, specifically in the Content Server component. The affected version is 14.1.2.0.0. An unauthenticated remote attacker with network access via HTTP can compromise Oracle WebCenter Content, provided a user other than the attacker performs a required interaction. The flaw is classified under CWE-284: Improper Access Control and produces a scope change, allowing impact to extend beyond the vulnerable component.

Critical Impact
Successful exploitation enables unauthorized creation, deletion, or modification of all Oracle WebCenter Content data, and unauthorized read access to all accessible data.

Affected Products

Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware (Content Server component)
Deployments exposing Content Server over HTTP to untrusted networks

Discovery Timeline

2026-06-17 - CVE-2026-46805 published to NVD
2026-06-17 - Oracle Critical Patch Update advisory (June 2026) released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-46805

Vulnerability Analysis

The vulnerability resides in the Content Server component of Oracle WebCenter Content. The flaw allows an unauthenticated attacker to reach an exposed HTTP code path that performs sensitive operations without sufficient access control checks. Because the issue maps to [CWE-284: Improper Access Control], the server fails to correctly authorize the requested action against the caller's identity or session context.

The vulnerability produces a scope change, meaning successful exploitation can impact resources beyond Oracle WebCenter Content itself. Confidentiality and integrity are both fully impacted, while availability is not affected, indicating the attack manipulates data state rather than disrupting service. Exploitation requires interaction from a user other than the attacker, consistent with attack patterns such as link-following or content-trigger workflows.

Root Cause

The root cause is improper access control within the Content Server request handling logic. The component does not adequately validate authorization before honoring a privileged operation, allowing an external HTTP requester to leverage a victim user's context to create, modify, or delete content.

Attack Vector

The attack vector is network-based over HTTP. The attacker crafts a malicious request or resource and induces an authenticated WebCenter user to trigger it, for example by visiting a malicious page or following a crafted link. The Content Server then processes the request without enforcing the necessary access control, granting the attacker the victim's effective privileges.

No verified proof-of-concept code is publicly available. Refer to the Oracle Security Alert - Critical Patch Update June 2026 for vendor-provided technical context.

Detection Methods for CVE-2026-46805

Indicators of Compromise

Unexpected creation, modification, or deletion of Content Server documents outside normal user workflows.
HTTP requests to WebCenter Content endpoints originating from external referrers or carrying cross-origin payloads.
Audit log entries showing privileged content operations performed in close temporal proximity to user web browsing activity.

Detection Strategies

Review Oracle WebCenter Content audit logs for anomalous IdcService invocations such as CHECKIN_NEW, DELETE_DOC, or UPDATE_DOCINFO tied to interactive sessions.
Correlate web proxy and endpoint telemetry to identify users who navigated to external sites immediately before suspicious Content Server actions.
Hunt for HTTP Referer headers in WebCenter access logs that point to untrusted domains preceding sensitive operations.

Monitoring Recommendations

Enable verbose auditing on the Content Server and forward logs to a centralized SIEM for retention and correlation.
Alert on bursts of content modifications or deletions from a single user session, particularly outside business hours.
Monitor WebCenter administrator and content contributor accounts for unusual activity patterns following exposure to external links.

How to Mitigate CVE-2026-46805

Immediate Actions Required

Apply the Oracle Critical Patch Update from June 2026 to all Oracle WebCenter Content 14.1.2.0.0 deployments without delay.
Restrict network exposure of the Content Server to trusted networks and authenticated reverse proxies only.
Notify privileged WebCenter users about the user-interaction requirement and reinforce caution with unsolicited links or content.

Patch Information

Oracle addressed CVE-2026-46805 in the June 2026 Critical Patch Update. Administrators must download and apply the relevant patch from the Oracle Security Alert - June 2026 CPU. Verify patch level after deployment and restart the Content Server to ensure the fix is loaded.

Workarounds

Place Oracle WebCenter Content behind a web application firewall configured to block cross-origin requests and enforce strict Referer and Origin validation.
Limit Content Server access to VPN or internal network segments until patching is complete.
Reduce the privileges of standard WebCenter accounts so a compromised session cannot perform bulk content changes.

bash

# Example: restrict Content Server access at the reverse proxy
location /cs/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_pass http://webcenter-backend;
}