CVE-2026-87299 in WebCenter Content
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data as well as unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Content Server component of Oracle WebCenter Content, a core part of the Oracle Fusion Middleware suite affecting versions 12.2.1.4.0 and 14.1.2.0.0. This flaw represents a significant security risk as it allows for unauthorized access to sensitive data stored by the application. The vulnerability is classified under CWE-79, which covers Cross-site Scripting (XSS), specifically involving improper neutralization of input during web page generation. In this context, the Content Server fails to adequately validate or sanitize user-supplied input before processing it through its HTTP interface. This lack of proper sanitization enables an attacker to inject malicious scripts into pages viewed by other users, thereby bypassing standard security controls that rely on same-origin policies and authentication checks for certain data retrieval operations.
From a technical perspective, the exploitability of this vulnerability is characterized by low complexity but requires human interaction. The attack vector is network-based via HTTP, meaning an unauthenticated attacker can initiate the exploitation process remotely without needing prior credentials. However, to achieve successful compromise, the attacker must induce another user with valid access privileges to interact with a maliciously crafted link or content hosted on a third-party site. This social engineering aspect aligns with ATT&CK technique T1566.002, which involves Spearphishing Link attacks where users are tricked into clicking links that lead to exploitation of the target application. Once the victim interacts with the payload, the malicious script executes within the context of the Oracle WebCenter Content domain, allowing it to access session cookies and other authentication tokens associated with the user's active session.
The operational impact of this vulnerability is substantial due to its potential for scope change. Although the flaw exists specifically in Oracle Web Center Content, successful exploitation can lead to unauthorized read, insert, update, or delete operations on data accessible by the compromised user account. This means that an attacker could exfiltrate sensitive documents, modify critical records, or even inject malicious content into shared repositories. The CVSS 3.1 base score of 6.1 reflects moderate severity, driven primarily by confidentiality and integrity impacts while availability remains unaffected. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates that the attack is network-accessible with low complexity but requires user interaction and has a changed scope, meaning the impact extends beyond just the vulnerable component to potentially affect other integrated systems or data stores linked through shared authentication mechanisms.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. Oracle should apply the latest available patches for WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 as soon as they become available in their official support channels. In environments where patching is not immediately feasible, administrators can implement compensating controls such as deploying a Web Application Firewall (WAF) to filter out malicious HTTP requests containing script injection patterns. Additionally, enforcing strict Content Security Policy headers and ensuring that session cookies are marked with the HttpOnly flag can mitigate some of the risks associated with cross-site scripting by preventing scripts from accessing sensitive cookie data. Regular security awareness training for users is also critical to reduce the likelihood of successful social engineering attacks that trigger this vulnerability.