Unauthenticated Attackers Can Take Over Oracle WebCenter Content

Security operations teams face a severe threat with the disclosure of CVE-2026-91495, a critical vulnerability in Oracle WebCenter Content. This flaw enables unauthenticated attackers with network access via HTTP to fully compromise the Content Server component. According to the NVD record, successful exploitation leads to a complete takeover of the Oracle WebCenter Content product. The issue affects specific supported versions, creating an immediate risk for organizations running these environments without additional network restrictions.

In plain English

The core issue involves a weakness in the Content Server component of Oracle Fusion Middleware. Attackers do not need valid usernames or passwords to exploit this flaw. They only need network access to the server over HTTP. Once they reach the vulnerable interface, they can execute actions that grant them full control over the system. This means an attacker can achieve a takeover of the Oracle WebCenter Content, impacting confidentiality, integrity, and availability.

The background

The vulnerability is present in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. These are the specific supported versions identified as affected by the flaw. The National Vulnerability Database assigns a CVSS 3.1 Base Score of 9.8 to this issue. This score reflects high impacts on confidentiality, integrity, and availability. The vector indicates the attack is network-based, requires low complexity, and needs no user interaction or privileges.

What changes now

Organizations using the affected versions must assess their exposure immediately. Since the vulnerability allows unauthenticated access, any system exposed to the internet or internal networks is at risk. Teams should verify their current version of Oracle WebCenter Content against the affected list. If running version 12.2.1.4.0 or 14.1.2.0.0, the environment is considered vulnerable until a fix is confirmed. Monitoring for unusual HTTP traffic to the Content Server is also advisable.

What made it possible

Teams usually see this class of flaw when input validation fails at the network boundary. The weakness relies on the application trusting unauthenticated requests from the network. It serves the initial access stage of an intrusion, bypassing standard identity checks. Check whether your firewall rules restrict HTTP access to the Content Server. Ensure that only trusted networks can reach the interface. Limit exposure by placing the server behind a reverse proxy that enforces strict authentication before forwarding requests.

Background: Firewalls

Start with a strict deny-all baseline. Define only the traffic you explicitly need. Apply rules in small batches during maintenance windows. Verify connectivity after each change. Monitor logs for denied packets to refine your policy and catch misconfigurations early.

Read the full guide: Implement Firewalls: A Step-by-Step Guide for Network Security

What to do and how to stay safe: Oracle WebCenter Content

• Verify if your environment runs Oracle WebCenter Content version 12.2.1.4.0 or 14.1.2.0.0.
• Restrict HTTP access to the Content Server to trusted internal networks only.
• Monitor logs for unusual unauthenticated HTTP requests to the Content Server interface.
• Prepare to apply updates once the vendor provides a confirmed patch for CVE-2026-91495.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Oracle WebCenter Content versions are affected by CVE-2026-91495?

Versions 12.2.1.4.0 and 14.1.2.0.0 are the supported versions affected by this vulnerability.

Does an attacker need a password to exploit this flaw?

No, the vulnerability allows unauthenticated attackers to compromise the system via HTTP.

What is the severity of CVE-2026-91495?

The NVD rates it as CRITICAL with a CVSS 3.1 Base Score of 9.8.