CVE-2026-87360 in WebCenter Content
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Content Server component of Oracle WebCenter Content, a core part of the Oracle Fusion Middleware suite affecting versions 12.2.1.4.0 and 14.1.2.0. This flaw represents a significant security risk for organizations relying on this platform for document management and content delivery services. The vulnerability is characterized by its difficulty to exploit, which stems from specific conditions that must be met before the attack can succeed. While the attacker requires only network access via HTTP and does not need prior authentication, the exploitation process involves complex steps that are not trivial to execute automatically without careful preparation or social engineering elements.
The technical nature of this flaw allows an unauthenticated actor to compromise the integrity and confidentiality of the system by leveraging human interaction as a critical vector for success. This requirement indicates that the vulnerability likely relies on tricking a legitimate user into performing an action, such as clicking a malicious link or opening a specially crafted document, which then triggers the exploitation sequence against the server. Once this interaction occurs, the attacker can bypass standard access controls to gain unauthorized entry into sensitive areas of the application. The absence of authentication requirements for the initial attack vector highlights a potential weakness in how input validation or session management is handled when user-triggered events are processed by the Content Server engine.
The operational impact of a successful exploitation is severe, primarily centered around data confidentiality rather than system availability or integrity modification. An attacker who successfully exploits this vulnerability can access critical data stored within the Oracle WebCenter Content repository. This includes sensitive documents, proprietary information, and personal identifiable information that may be hosted on the compromised server. In worst-case scenarios, the attacker gains complete read-only access to all data accessible through the platform, effectively turning a content management system into an unauthorized database dump tool. The CVSS 3.1 base score of 5.3 reflects this medium-level severity, driven by high confidentiality impact but limited scope for integrity or availability damage due to the difficult exploitation and human interaction requirements.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation if the flaw involves malformed requests that bypass checks after user interaction, or potentially CWE-798 if it relates to hardcoded credentials in configuration files exposed through specific interactions. In terms of offensive security frameworks like MITRE ATT&CK, this behavior maps closely to techniques involving social engineering for initial access followed by data exfiltration from local system resources. The requirement for human interaction places the exploitation phase within the context of user execution tactics where adversaries manipulate users into taking actions that facilitate further compromise.
Mitigation strategies must focus on both technical controls and administrative policies given the unique exploit conditions. Organizations should immediately apply the latest security patches provided by Oracle to address this specific flaw in their WebCenter Content installations. Since the vulnerability requires human interaction, implementing strict web application firewalls with advanced behavioral analysis can help detect and block suspicious HTTP requests that exhibit patterns consistent with exploitation attempts. Additionally, enforcing multi-factor authentication for administrative accounts reduces the risk of lateral movement if initial access is gained. User awareness training is also critical to prevent social engineering attacks that could trigger this vulnerability by convincing employees to interact with malicious content hosted on or linked from compromised systems. Regular audits of accessible data and monitoring logs for unusual access patterns can aid in early detection of any attempted exploitation activities.