CVE-2026-91495 in WebCenter Content
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Content Server component of Oracle WebCenter Content, a critical enterprise application included in the Oracle Fusion Middleware suite. This security flaw affects specific supported releases, namely version 12.2.1.4.0 and version 14.1.2.0.0. The nature of this defect is particularly severe because it permits an unauthenticated attacker to execute arbitrary code or gain control over the system without requiring any prior credentials or user interaction. This characteristic significantly lowers the barrier for exploitation, allowing individuals with basic network access via HTTP to target the vulnerable infrastructure directly.
From a technical perspective, the flaw enables complete compromise of the Oracle WebCenter Content environment. The ability to achieve takeover implies that an attacker can manipulate application logic, inject malicious payloads, or escalate privileges within the server context. This level of access allows for comprehensive control over the underlying operating system and data stored by the content management system. Such a breach fundamentally undermines the security posture of the organization, as the Content Server often holds sensitive corporate documents, intellectual property, and confidential records that are central to business operations.
The operational impact of this vulnerability is profound due to its high severity rating. With a CVSS 3.1 Base Score of 9.8, classified as Critical, the risk encompasses all three pillars of information security: confidentiality, integrity, and availability. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack is network-based with low complexity, requires no privileges or user interface interaction, and results in high impacts across all security dimensions. Consequently, successful exploitation can lead to unauthorized disclosure of sensitive data, alteration of critical content without authorization, and disruption of service availability, effectively rendering the system unusable for legitimate users while exposing it to further malicious activities such as lateral movement within the network.
In terms of industry classification standards, this vulnerability aligns with CWE-94, which describes Improper Control of Generation of Code (Code Injection), or potentially CWE-502 if it involves deserialization issues leading to remote code execution. From a tactical standpoint, according to the MITRE ATT&CK framework, this exploit facilitates initial access and privilege escalation techniques commonly associated with unauthenticated web application attacks. Attackers may leverage tools like Metasploit or custom scripts to automate the exploitation process against multiple targets simultaneously due to the low complexity of the attack vector.
To mitigate this risk, organizations must immediately apply the latest security patches provided by Oracle for the affected versions 12.2.1.4.0 and 14.1.2.0.0. It is imperative to verify that all instances of WebCenter Content are updated to a version where this flaw has been remediated. In addition to patching, administrators should implement network-level controls such as web application firewalls to filter malicious HTTP requests targeting the vulnerable endpoints. Restricting direct internet access to these services and ensuring they are only accessible through secure, authenticated channels can further reduce the attack surface while patches are being deployed across the infrastructure.