CVE-2026-87298 in WebCenter Content
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Content Server component of Oracle WebCenter Content, a core part of the Oracle Fusion Middleware suite. This security flaw affects specific supported versions, namely 12.2.1.4.0 and 14.1.2.0.0, indicating that even recently patched or maintained releases are susceptible to exploitation. The nature of this vulnerability allows for remote compromise by an attacker who possesses only low-level privileges within the target environment. This is a critical distinction because it lowers the barrier to entry significantly; attackers do not need administrative rights or complex authentication bypasses beyond basic user access, making the attack surface broader and more accessible to less sophisticated threat actors compared to high-privilege exploits.
The technical mechanism of this flaw enables exploitation over standard HTTP network connections without requiring any user interaction such as clicking a malicious link or opening a crafted file. This absence of a user interface requirement classifies the vulnerability under CWE-79, which pertains to Cross-Site Scripting (XSS) or similar injection-based flaws where input validation is insufficient. However, given the outcome described in the advisory, it may also align with CWE-200, an Information Exposure Vulnerability, if the primary impact is data leakage rather than code execution. The attacker leverages network access to send specifically crafted HTTP requests that trigger improper handling of sensitive information within the Content Server application logic. This allows the adversary to bypass intended security controls and retrieve data that should remain restricted based on their current privilege level.
The operational impact of a successful exploitation is severe, primarily centered around confidentiality breaches rather than integrity or availability disruptions. The vulnerability results in unauthorized access to critical data stored within the Oracle WebCenter Content repository. Depending on the sensitivity of the documents managed by the organization, this could lead to the exposure of proprietary intellectual property, personally identifiable information (PII), financial records, or other regulated data. While the CVSS 3.1 base score is rated at 6.5 with a focus on confidentiality impacts, meaning integrity and availability are not directly compromised in this specific vector, the loss of confidential data can have profound legal, regulatory, and reputational consequences for the affected organization. The attack aligns with MITRE ATT&CK technique T1005, which describes Data from Local System, as it involves exfiltrating information that is already accessible to some degree but restricted by proper access controls.
To mitigate this risk, organizations running the affected versions of Oracle WebCenter Content must apply the latest security patches provided by Oracle immediately. It is essential to verify the specific patch set associated with CVE identifiers linked to these version numbers and ensure deployment in both production and staging environments before rollout. In addition to applying updates, administrators should enforce strict network segmentation policies to limit HTTP access to the Content Server components only from trusted subnets or through secure web application firewalls that can inspect and filter malicious payloads. Implementing robust input validation on any custom integrations or APIs interacting with the Content Server is also advisable as a defense-in-depth measure. Regular vulnerability scanning and penetration testing should be conducted to identify similar misconfigurations or unpatched components across the middleware infrastructure, ensuring that low-privilege accounts are monitored for anomalous data access patterns indicative of exploitation attempts.