Oracle WebCenter Content Has Critical Unauthenticated Takeover Vulnerability

The National Vulnerability Database has recorded CVE-2026-91495 as a critical security flaw in Oracle WebCenter Content. This vulnerability exists within the Content Server component of Oracle Fusion Middleware. It allows an unauthenticated attacker to compromise the system entirely. The issue is easily exploitable over standard network connections using HTTP.

Security researchers rate this vulnerability with a CVSS 3.1 base score of 9.8. This maximum-level score indicates severe impacts on confidentiality, integrity, and availability. The attack vector is network-based, meaning the attacker does not need local access. The complexity of the attack is low, and no user interaction is required for successful exploitation.

Technical Details and Impact

The flaw permits a remote attacker to take over Oracle WebCenter Content. Successful exploitation results in takeover of the affected system. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This vector confirms that the attack requires no privileges and no user interface interaction.

The high scores for confidentiality, integrity, and availability reflect the severity of the potential breach. An attacker can compromise the system via HTTP. The ease of exploitation makes this a high-priority target for threat actors scanning for exposed Oracle infrastructure.

Affected Versions and Scope

Only specific versions of Oracle WebCenter Content are impacted by this vulnerability. The affected releases are version 12.2.1.4.0 and version 14.1.2.0.0. Organizations running these exact builds are at risk if the servers are accessible via HTTP. Other versions of Oracle Fusion Middleware are not listed as affected in this record.

Administrators must verify their current installation versions against this list. If the server is running either of the two affected versions, it is vulnerable to takeover. The vulnerability is inherent in the Content Server component, which is central to document management functions.

What should you do?

Security teams should immediately inventory their Oracle WebCenter Content deployments. Identify any servers running versions 12.2.1.4.0 or 14.1.2.0.0. Since the flaw is easily exploitable, exposure to untrusted networks increases risk significantly. Monitor network traffic for unusual HTTP requests to the Content Server endpoints.

The source material does not confirm the availability of a patch or fix. Until the vendor provides an update, consider restricting network access to the affected servers. Use firewalls to block HTTP traffic from untrusted sources. Watch for official advisories from Oracle regarding remediation steps.

What to do and how to stay safe: Oracle

• Audit all servers running Oracle WebCenter Content to identify versions 12.2.1.4.0 and 14.1.2.0.0.
• Restrict HTTP access to the Content Server to trusted internal networks only.
• Monitor web server logs for suspicious unauthenticated requests or unusual activity.
• Subscribe to Oracle security alerts for updates on CVE-2026-91495 patches.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Oracle products are affected by CVE-2026-91495?

The vulnerability affects Oracle WebCenter Content, specifically the Content Server component of Oracle Fusion Middleware.

What is the severity rating of this vulnerability?

The National Vulnerability Database rates CVE-2026-91495 as Critical with a CVSS 3.1 score of 9.8.

Can an attacker exploit this without logging in?

Yes, the vulnerability allows an unauthenticated attacker to exploit the flaw via HTTP without user interaction.