CVE-2026-70858 in WebCenter Content
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data as well as unauthorized read access to a subset of Oracle WebCenter Content accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Content. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Content Server component of Oracle WebCenter Content, a core part of the Oracle Fusion Middleware suite affecting versions 12.2.1.4.0 and 14.1.2.0. This security flaw is characterized by an easily exploitable condition that permits unauthenticated attackers to compromise the system via network access through HTTP protocols. The nature of this vulnerability allows for remote exploitation without requiring prior authentication, which significantly lowers the barrier for entry compared to vulnerabilities demanding valid credentials or complex local privilege escalation steps.
A critical aspect of this specific flaw is its reliance on human interaction from a victim other than the attacker. This characteristic aligns with social engineering vectors where an unauthenticated user must be tricked into performing a specific action, such as clicking a malicious link or uploading a crafted file, to trigger the exploit condition. Despite requiring this user intervention, the vulnerability remains highly dangerous due to its low attack complexity and network accessibility. The requirement for human interaction places it within the domain of CWE-79, which covers Cross-Site Scripting vulnerabilities where an attacker injects malicious scripts into web pages viewed by other users, or potentially CWE-436 if interpreted as a parsing flaw leading to unintended execution contexts triggered by user input.
The operational impact of successful exploitation is substantial and multifaceted, affecting the confidentiality, integrity, and availability of Oracle WebCenter Content data. Attackers can achieve unauthorized read access to a subset of accessible content, leading to potential data leakage and privacy violations. Furthermore, the vulnerability permits unauthorized updates, inserts, or deletes against some of the accessible data, compromising system integrity by allowing malicious modification or destruction of stored information. Additionally, attackers possess the ability to cause a partial denial of service, disrupting availability for legitimate users by exhausting resources or causing application instability. These combined impacts result in a CVSS 3.1 Base Score of 7.1, indicating a High severity rating that warrants immediate attention from security operations teams.
From an attack perspective, this vulnerability exhibits characteristics consistent with the ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques if code execution is involved, or more broadly under Initial Access vectors like T1189 Drive-by Compromise due to the human interaction requirement. The scope change mentioned in the advisory suggests that while the flaw exists within Oracle WebCenter Content, its exploitation can lead to lateral movement or compromise of dependent systems and integrated applications, thereby expanding the blast radius beyond the immediate application boundary. This amplifies the risk profile as it may expose backend databases or other middleware components connected to the compromised instance.
Mitigation strategies should prioritize applying the latest security patches provided by Oracle for the affected versions 12.2.1.4.0 and 14.1.2.0.0 immediately upon availability. In environments where patching is not instantly feasible, network-level controls such as Web Application Firewalls can be configured to detect and block patterns associated with this specific exploit vector, particularly those involving suspicious HTTP requests that trigger the vulnerability condition. Input validation and sanitization mechanisms should also be reviewed within custom integrations or scripts interacting with Content Server APIs to ensure they do not inadvertently facilitate similar injection flaws. Continuous monitoring for anomalous activity related to content uploads or modifications is recommended to detect potential exploitation attempts in real-time, thereby reducing the window of exposure and limiting the impact on organizational data assets.