CVE-2026-87390: Infoleak
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Content. CVSS 3.1 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Oracle WebCenter Content Content Server deployments on versions 12.2.1.4.0 and 14.1.2.0.0 are affected if they are reachable by an attacker over HTTP. The attacker does not need an account or other privileges.
What must happen for exploitation to succeed?
An unauthenticated attacker needs network access via HTTP and must induce interaction by a person other than the attacker. Exploitation is rated low complexity.
What is the potential impact of a successful attack?
An attacker may gain unauthorized ability to update, insert, or delete some accessible Oracle WebCenter Content data. They may also cause a partial denial of service affecting Oracle WebCenter Content.