CVE-2026-87374 in WebCenter Content
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Content Server component of Oracle WebCenter Content, a core part of the Oracle Fusion Middleware suite affecting versions 12.2.1.4.0 and 14.1.2.0. This security flaw presents a significant risk to organizations relying on these specific releases for document management and content collaboration services. The vulnerability is characterized by its difficulty in exploitation, which suggests that while the underlying technical defect may be complex or require precise conditions to trigger, it remains accessible to attackers who can meet those specific criteria. Despite this high barrier to entry, the potential impact of a successful exploit is severe, targeting both the confidentiality and integrity aspects of data security rather than availability.
From a technical perspective, the flaw allows an attacker with low privileges and network access via HTTP to compromise the system. This indicates that no authentication or only minimal user credentials are required to initiate the attack vector through standard web protocols. The nature of this vulnerability aligns closely with CWE-269 Improper Privilege Management, as it enables a lower-privileged entity to perform actions typically reserved for higher-level administrators or trusted processes. Furthermore, because the exploitation occurs over HTTP without requiring user interaction, it maps directly to ATT&CK technique T1078 Valid Accounts and potentially T1133 External Remote Services if the service is exposed externally. The lack of required user interface interaction simplifies the attack path for automated tools, although the high complexity rating implies that specific input manipulation or state exploitation techniques are necessary to achieve code execution or data access.
The operational impact of this vulnerability is substantial due to its effects on confidentiality and integrity. A successful compromise grants unauthorized creation, deletion, or modification capabilities over critical data within the Oracle WebCenter Content environment. This means an attacker could alter essential documents, inject malicious content, or remove vital records, thereby undermining trust in the system's output. Additionally, the vulnerability permits unauthorized access to sensitive information that would otherwise be protected by role-based access controls. The ability to read all accessible data effectively breaks the isolation mechanisms intended to protect proprietary or personal information stored within the platform. This dual impact on confidentiality and integrity poses a direct threat to business continuity and regulatory compliance, particularly for industries governed by strict data protection standards such as GDPR, HIPAA, or PCI-DSS.
The CVSS 3.1 base score of 6.8 reflects this moderate-to-high severity level. The vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) highlights that while the attack requires high complexity and low privileges, it results in high confidentiality and integrity impacts with no impact on availability. This profile suggests that defenders should prioritize patching this vulnerability not because it is easy to exploit, but because the consequences of a successful breach are severe enough to warrant immediate attention once an attacker overcomes the initial technical hurdles. The absence of availability impact indicates that denial-of-service attacks are not a primary concern with this specific flaw, allowing security teams to focus on preventing unauthorized data access and modification rather than service restoration.
Mitigation strategies must begin with applying the latest available patches or updates provided by Oracle for the affected versions 12.2.1.4.0 and 14.1.2.0. Organizations should verify their deployment status against these specific version numbers to determine exposure. In environments where immediate patching is not feasible, network segmentation strategies can help reduce risk by restricting HTTP access to the Content Server component only from trusted internal subnets or through secure proxy layers that enforce stricter authentication requirements before traffic reaches the vulnerable service. Implementing Web Application Firewalls with rules tailored to detect anomalous request patterns associated with privilege escalation attempts may also provide a layer of defense against exploitation attempts. Regular auditing of user privileges and monitoring for unusual data modification activities are essential operational controls to detect potential compromises early.