CVE-2026-87370 in WebCenter Content
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Content Server component of Oracle WebCenter Content, a core part of the Oracle Fusion Middleware suite. This security flaw affects specific supported versions, namely 12.2.1.4.0 and 14.1.2.0.0. The nature of this defect is characterized as difficult to exploit, which implies that it requires complex conditions or precise timing to be leveraged successfully by an adversary. Despite the high difficulty level, the attack vector is network-based, allowing a low-privileged attacker with access via HTTP to initiate the compromise process. This accessibility through standard web protocols makes the vulnerability particularly relevant for internet-facing deployments where authentication controls may not fully mitigate all entry points or where social engineering can bypass initial privilege requirements.
The operational impact of this vulnerability extends beyond the immediate target system due to a scope change in the CVSS scoring model. While the flaw is technically located within Oracle WebCenter Content, successful exploitation allows an attacker to compromise additional products that interact with or rely on data from the affected middleware component. This lateral movement capability significantly amplifies the risk profile of the vulnerability. The primary consequences involve unauthorized access to critical data and complete access to all data accessible by Oracle WebCenter Content. Furthermore, attackers gain the ability to perform unauthorized updates, inserts, or deletes against some of this accessible data. These actions directly compromise both the confidentiality and integrity aspects of the CIA triad, leading to potential data leakage, corruption, or loss depending on the specific operations executed during exploitation.
From a technical classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation if the flaw stems from inadequate sanitization of HTTP requests, or potentially CWE-79 Cross-site Scripting if user interaction is required to trigger client-side code execution that leads to data exfiltration. The requirement for human interaction suggests a potential alignment with ATT&CK technique T1566 Phishing, where an attacker might lure a victim into performing an action that triggers the vulnerability in the background. Alternatively, it could relate to T1078 Valid Accounts if the low-privileged access is obtained through compromised credentials or weak authentication mechanisms. The high complexity of exploitation indicates that automated scanning tools may not easily detect this issue, requiring more sophisticated manual testing or specific exploit chains involving social engineering components.
Mitigation strategies should focus on both technical controls and procedural safeguards. Oracle has likely released patches for versions 12.2.1.4.0 and 14.1.2.0.0 that address the underlying code flaw, making patching the primary remediation step. Organizations must ensure that all instances of WebCenter Content are updated to the latest security-fix release immediately upon availability. In addition to patching, network segmentation should be reviewed to limit HTTP access to only necessary IP ranges and users. Implementing strict input validation at the application layer can help mitigate similar flaws in other components. Security awareness training is also critical given the human interaction requirement; employees must be educated on recognizing suspicious links or actions that could trigger such vulnerabilities. Regular vulnerability assessments focusing on middleware components will help identify unpatched systems before they are exploited by adversaries leveraging this specific attack vector.