CVE-2026-87399 in WebCenter Content
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Content Server component of Oracle WebCenter Content, specifically affecting version 14.1.2.0.0 which is part of the broader Oracle Fusion Middleware suite. This security flaw represents a significant risk to organizations relying on this platform for document management and content collaboration services. The core issue stems from an easily exploitable weakness that allows attackers with low privileges to compromise the integrity and confidentiality of the system through standard HTTP network connections. Unlike high-severity vulnerabilities that often require complex exploitation chains or elevated permissions, this flaw is accessible via basic web protocols, making it a persistent threat for any instance exposed to internal or external networks where user authentication is present but not strictly enforced at an administrative level.
The technical nature of the vulnerability involves conditions under which low-privileged users can trigger actions that lead to unauthorized modifications or deletions of critical data within the Content Server repository. The attack vector requires human interaction from a victim other than the attacker, indicating that this is likely a Cross-Site Request Forgery (CSRF) type flaw or a similar social engineering-dependent vulnerability where an authenticated user's session can be manipulated into performing unintended actions. This reliance on user interaction does not diminish the severity but rather shifts the exploitation complexity to include psychological manipulation or deceptive links embedded in emails, forums, or other web content accessible by target users. The attacker leverages these interactions to execute commands that alter system state without proper authorization checks being validated against the intended action context.
The operational impact of this vulnerability is substantial due to its direct effect on data integrity and confidentiality. Successful exploitation enables an unauthorized actor to create, delete, or modify critical data stored within Oracle WebCenter Content. This capability undermines the trustworthiness of the content management system, potentially leading to loss of important documents, corruption of metadata, or deletion of essential records that are vital for business continuity. Furthermore, the vulnerability grants unauthorized read access to a subset of accessible data, allowing attackers to exfiltrate sensitive information such as proprietary designs, financial reports, or personal identifiable information depending on what is stored in the repository. The combination of write and read capabilities means that an attacker can not only steal data but also alter it to mislead stakeholders or cover their tracks after extraction.
From a classification perspective, this vulnerability aligns with CWE-352 Cross-Site Request Forgery if the mechanism involves tricking users into submitting requests, or potentially CWE-918 Server-Side Request Forgery depending on specific implementation details regarding how server-side actions are triggered by client inputs. In terms of MITRE ATT&CK framework mapping, this behavior corresponds to techniques involving social engineering and privilege escalation within application logic, specifically falling under tactics like Execution and Collection as the attacker seeks to manipulate user sessions to access or alter data. The CVSS 3.1 base score of 6.3 reflects a medium severity rating driven by high integrity impact and low confidentiality impact, with an attack complexity that is considered low due to ease of exploitation but mitigated slightly by the requirement for human interaction.
Mitigation strategies must focus on both immediate technical controls and long-term architectural improvements. Organizations should immediately apply the latest security patches provided by Oracle for WebCenter Content version 14.1.2.0.0, as vendor updates typically address these logic flaws through enhanced input validation or session management fixes. In addition to patching, implementing strict anti-CSRF tokens in all forms and state-changing HTTP requests is critical to prevent unauthorized actions from being processed by the server. Access controls should be reviewed to ensure that low-privileged users have minimal permissions necessary for their roles, adhering to the principle of least privilege. Network segmentation can also help limit exposure by restricting access to the Content Server interface only through trusted networks or secure virtual private network tunnels rather than exposing it directly via HTTP over public internet connections where feasible.