CVE-2026-46806: Oracle WebCenter Content Open Redirect Vulnerability – CVSS 8.2

Technical summary

CVE-2026-46806 is a URL redirection vulnerability (CWE-601, also known as Open Redirect) in Oracle WebCenter Content 14.1.2.0.0. The vulnerability stems from improper validation of redirect parameters in HTTPS endpoints, allowing an attacker to craft a URL that appears legitimate but redirects to an external, attacker-controlled site. The high CVSS score of 8.2 reflects the combination of network accessibility (AV:N), low attack complexity (AC:L), no authentication required (PR:N), the need for user interaction (UI:R), and a scope change (S:C) that extends impact beyond the directly vulnerable component. The primary impact is confidentiality loss (C:H), with some integrity compromise (I:L).

Business impact

Compromised WebCenter Content instances can expose confidential documents, contracts, intellectual property, and customer data to unauthorized parties. Because the vulnerability can affect downstream systems beyond WebCenter Content itself, a breach may extend to enterprise applications that trust or integrate with the content repository. Attackers can also modify or insert malicious content into the repository, potentially poisoning trusted documents or introducing malware-laden files that other users download. Organizations relying on WebCenter Content as a central document management system face reputational, compliance (GDPR, HIPAA, SOX), and operational risks.

Affected systems

Oracle WebCenter Content version 14.1.2.0.0 is explicitly affected. Organizations should verify their WebCenter Content deployment version immediately and check for any connected or dependent systems (including other Oracle Fusion Middleware products, custom integrations, and third-party applications that retrieve or reference WebCenter Content). The vulnerability affects unauthenticated users, so every instance exposed to a network—whether internal or external—is at risk if users can be socially engineered.

Exploitability

This vulnerability is easily exploitable because it requires no authentication, has low attack complexity, and relies on standard network access. However, successful attacks depend on user interaction—an employee must click a malicious link or visit a rigged webpage. Attackers typically craft convincing phishing emails that direct users to a WebCenter Content instance with a poisoned redirect URL. Once clicked, the user may be sent to a credential harvesting site, malware distribution point, or external content repository controlled by the attacker. The barrier to weaponization is low; no zero-day exploit kit is necessary, making widespread abuse a realistic concern.

Remediation

Patch Oracle WebCenter Content to a version that fixes CWE-601 validation—consult the official Oracle security advisory for the specific patched version applicable to your deployment. Until patching is complete, implement network controls to restrict WebCenter Content access to authorized users and networks, enforce multi-factor authentication where possible, and deploy email security and URL reputation filtering to block malicious links at the gateway. Consider implementing a Web Application Firewall (WAF) rule to detect and block suspicious redirect parameters in WebCenter Content requests.

Patch guidance

Contact Oracle Support or review the Oracle Security Advisory for CVE-2026-46806 to obtain the patched version for Oracle WebCenter Content. Test the patch in a non-production environment first to ensure compatibility with custom extensions and integrations. Coordinate with teams that depend on WebCenter Content to minimize downtime. After patching, verify that redirect functionality is restricted to allow-listed internal destinations only and that user sessions are cleared to force re-authentication.

Detection guidance

Monitor WebCenter Content logs for suspicious redirect parameters or unusual URL patterns in HTTP requests (look for encoded or obfuscated external URLs in query strings). Use a WAF or SIEM to alert on requests containing patterns like 'redirect=http' or similar parameter names pointing to non-approved domains. Check for spikes in failed authentication or credential submission attempts on landing pages following the CVE disclosure, as attackers may test redirect chains. Threat intelligence feeds and your email security solution should flag phishing campaigns leveraging this CVE.

Why prioritize this

A CVSS score of 8.2 (HIGH severity) combined with easy exploitability and the potential for scope change across the enterprise makes this a top-tier threat. Organizations must prioritize patching because the attack vector is network-based and unauthenticated, and the impact includes complete loss of confidentiality for sensitive documents. The reliance on user interaction does not materially reduce risk in a real-world context where phishing and social engineering remain highly effective. Any WebCenter Content instance exposed to users or the internet should be treated as critical.

Risk score, explained

The CVSS 3.1 base score of 8.2 reflects: network accessibility (AV:N) and no authentication requirement (PR:N), which makes the attack broadly feasible; low attack complexity (AC:L), meaning the attacker needs no special knowledge or tools; a scope change (S:C) indicating that exploitation affects more than just the vulnerable component; high confidentiality impact (C:H), allowing full disclosure of data; and limited but real integrity impact (I:L). The main limiting factor is the requirement for user interaction (UI:R), which prevents fully automated, massive-scale exploitation but remains a weak control in practice. No availability impact (A:N) prevents a higher rating, but confidentiality and integrity breaches are sufficient for critical enterprise risk.

Frequently asked questions