External risk intelligence

Oracle WebCenter Content Imaging Unauthorized Data Access Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-46784

A critical vulnerability exists in Oracle WebCenter Content: Imaging, allowing unauthenticated attackers with network access to compromise critical data. Successful exploitation could lead to unauthorized creation, deletion, or modification of data, or complete access to all accessible data within the system. This impa

Halo Surface Signal

Likely · external exposure

4Halo Surface Signal

Oracle WebCenter Content: Imaging is an enterprise web application designed to handle content and imaging, which is frequently exposed to the internet or accessible via internal networks to facilitate document management, web-based workflows, and integration with other web services, making it a likely target for remote, unauthenticated HTTP-based network access.

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle WebCenter Content: Imaging, part of Oracle Fusion Middleware. This issue, if exploited, could allow unauthorized access to sensitive data, including the ability to modify or delete critical information within the system. The main concern is confirming the relevance and exposure of this product within our environment.

  • Unauthenticated attackers can access imaging data.
  • Protects critical business information and operations.
  • Confirm exposure and assess impact for affected systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending malicious network requests to an exposed Oracle WebCenter Content: Imaging service. Because no authentication is required, any attacker with network access can initiate these requests, leading to unauthorized data manipulation or access.

  • Unauthenticated network access required.
  • Attacker triggers vulnerability via HTTP.
  • Leads to unauthorized data access or modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker with network access to unauthorizedly access, modify, or delete critical data within WebCenter Content: Imaging. This could lead to a compromise of sensitive information or the integrity of the system's stored data.

  • Critical system data could be exposed.
  • Via network access over HTTP.
  • Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Oracle WebCenter Content: Imaging product is likely managed by application owners, with potential oversight from platform or infrastructure teams, and security teams responsible for network exposure. The first practical step is to identify all instances of WebCenter Content: Imaging, confirm their accessibility and business criticality, and then assign ownership to initiate a risk-based remediation plan.

  • Identify and assign responsible teams.
  • Verify product reachability and criticality.
  • Plan remediation based on identified risk.

Supplementary metadata

PCI scan relevance

Yes

CVE-2026-46784 — Halo PCI Relevance: Yes. Under typical PCI ASV external scan criteria, this issue may be flagged for scan prioritization.

This vulnerability in Oracle WebCenter Content: Imaging allows unauthenticated attackers to access or modify critical data, which would likely cause a PCI ASV scan failure.

Scan-prioritization guidance only—not a PCI DSS certification or ASV attestation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebCenter Content: Imaging?

It is an enterprise software component within Oracle Fusion Middleware designed to manage, store, and process business documents and imaging files. Organizations use it to centralize content, automate workflows, and provide web-based access to critical data for users across the enterprise.

What does CWE-284 mean for CVE-2026-46784?

CWE-284 refers to Improper Access Control. In the context of this vulnerability, it means the software fails to properly verify the identity or permissions of a user. Because of this weakness, the application does not enforce its security boundaries, allowing an attacker to bypass authentication and interact with data they are not authorized to access.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specifically crafted HTTP requests to the target service. No special user interaction is required. It is important to note that the vulnerability is not triggered by legitimate, authenticated user workflows or routine file uploads; it specifically requires the absence of proper access control checks on the network request.

Is my system at risk if it is not internet-facing?

Halo Surface Signal indicates that while this product is often exposed to the internet, it is frequently used on internal networks to support local document management. Because the vulnerability requires only network access, any system reachable from a compromised internal segment or accessible via the internet faces potential risk.

What should I do first to address this?

Start by performing an inventory to locate all instances of WebCenter Content: Imaging in your environment. Once identified, verify which systems are reachable over the network and determine their business criticality. Coordinate with the application owners to assess the risk and prepare for updates.

References

Sources and related resources

Primary sources: NVD, CVE.org.

NVDPublished