CVSS 9.8: Critical Oracle WebCenter Content Flaw Lets Attackers Seize Servers Without Credentials

A critical security flaw in Oracle WebCenter Content exposes organizations to immediate remote takeover risks. The vulnerability, tracked as CVE-2026-91495, allows an unauthenticated attacker with network access to compromise the Content Server component. According to the National Vulnerability Database, the issue carries a CVSS 3.1 Base Score of 9.8. This rating reflects high impacts on confidentiality, integrity, and availability. The flaw is easily exploitable over standard HTTP connections, meaning no authentication is required for an attacker to initiate a compromise.

Which Oracle WebCenter Content versions are vulnerable?

Only two specific supported versions of the product are affected by this critical vulnerability. Organizations running Oracle WebCenter Content version 12.2.1.4.0 are exposed to the risk. Additionally, those operating version 14.1.2.0.0 face the same threat. Other versions of the Oracle Fusion Middleware suite or different components within WebCenter Content are not listed as affected in the National Vulnerability Database record. Teams must verify their exact build numbers to determine if their environment falls within this narrow scope of exposure.

How does an attacker exploit this vulnerability?

Exploitation requires only network access via HTTP to the vulnerable Content Server. The attacker does not need valid user credentials or prior authentication to trigger the flaw. According to the NVD description, the vulnerability is easily exploitable. Once an attacker sends the necessary request, they can achieve a full takeover of the Oracle WebCenter Content instance. This results in complete compromise of the server, granting the attacker control over the system’s confidentiality, integrity, and availability without any user interaction.

What is the severity rating for CVE-2026-91495?

The National Vulnerability Database rates CVE-2026-91495 as critical with a CVSS 3.1 Base Score of 9.8. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This score indicates that the attack vector is network-based, attack complexity is low, no privileges are required, and no user interaction is needed. The scope is unchanged, but the impact on confidentiality, integrity, and availability is high. This combination creates a worst-case scenario for remote code execution vulnerabilities, demanding immediate attention from security teams.

Is a patch or fix available yet?

The source material does not mention the release of a patch, update, or temporary fix for CVE-2026-91495. No vendor statement confirming a remediation is included in the provided NVD record. Security teams should assume that no fix has been confirmed yet. Until Oracle releases an official update, affected systems remain vulnerable to unauthenticated takeover. Organizations should monitor official Oracle security advisories for any announcements regarding patches or mitigations for versions 12.2.1.4.0 and 14.1.2.0.0.

Detection notes

Security operations teams should monitor for unusual HTTP traffic patterns targeting the Content Server component. Look for requests from unknown IP addresses that result in high resource consumption or unexpected process creation. Check web server logs for successful responses to requests that lack valid authentication tokens. Alert on any outbound connections from the server that were not previously established. If suspicious activity is detected, isolate the affected server from the network immediately to prevent lateral movement. Review access logs for signs of unauthorized command execution or data exfiltration.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: Oracle

• Verify if your organization runs Oracle WebCenter Content versions 12.2.1.4.0 or 14.1.2.0.0.
• Restrict network access to the Content Server to trusted IP addresses only, if possible.
• Monitor HTTP logs for unauthenticated requests that result in successful server responses.
• Prepare an incident response plan for potential remote code execution on affected systems.

Step-by-step guide: Lateral Movement Prevention Checklist for Network Security

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-91495?

The CVSS 3.1 Base Score is 9.8, which is rated as critical severity.

Which Oracle WebCenter Content versions are affected?

Versions 12.2.1.4.0 and 14.1.2.0.0 are affected by this vulnerability.

Does an attacker need credentials to exploit this flaw?

No, the vulnerability allows an unauthenticated attacker to compromise the server.