Description
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebCenter Content. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (Availability)
Action: Patch Immediately
AI Analysis

Impact

The vulnerability enables a low-privileged attacker with network access over HTTP to send crafted requests that cause the Oracle WebCenter Content server to hang or crash, leading to a complete denial of service. It is a CWE-200 weakness, indicating an information exposure flaw that in this context allows an attacker to trigger server crashes. The vulnerability does not provide confidentiality or integrity compromise, but it can disrupt business operations by taking the application offline.

Affected Systems

Oracle Corporation’s WebCenter Content product is affected, specifically versions 12.2.1.4.0 and 14.1.2.0.0. No other products are listed as impacted.

Risk and Exploitability

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) assigns a score of 6.5, indicating moderate severity with significant impact on availability. The EPSS score is less than 1%, indicating a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only network connectivity to the HTTP endpoint of the WebCenter Content server and can be performed by an attacker with no elevated privileges, making it relatively easy to execute within a network that can reach the target.

Generated by OpenCVE AI on October 28, 2026 at 18:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle WebCenter Content patch for versions 12.2.1.4.0 and 14.1.2.0.0 as published in the official CPU Oct 2026 advisory.
  • If immediate patching is not possible, configure the application firewall or reverse proxy to reject malformed HTTP requests and limit the rate of requests to the Content Server.
  • After applying the fix or implementing traffic controls, monitor the application logs for repeated crashes or abnormal error messages to verify the effectiveness of the mitigation.

Generated by OpenCVE AI on October 28, 2026 at 18:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Title Oracle WebCenter Content Denial of Service via Crafted HTTP Requests

Wed, 28 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Title Denial of Service Vulnerability in Oracle WebCenter Content via Malformed HTTP Requests
Weaknesses CWE-400
CWE-770

Wed, 28 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle Corporation
Oracle Corporation oracle Webcenter Content
Vendors & Products Oracle Corporation
Oracle Corporation oracle Webcenter Content

Wed, 21 Oct 2026 08:30:00 +0000

Type Values Removed Values Added
Title Denial of Service Vulnerability in Oracle WebCenter Content via Malformed HTTP Requests
Weaknesses CWE-400
CWE-770

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebCenter Content. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle webcenter Content
CPEs cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_content:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Content
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Webcenter Content
Oracle Corporation Oracle Webcenter Content
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T14:07:15.286Z

Reserved: 2026-09-08T21:49:12.414Z

Link: CVE-2026-87365

cve-icon Vulnrichment

Updated: 2026-10-28T14:07:09.410Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:14.487

Modified: 2026-11-03T18:13:56.283

Link: CVE-2026-87365

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T18:15:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor