Description
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebCenter Content. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service (Availability)
Action: Patch Immediately
AI Analysis

Impact

The vulnerability enables a low‑privileged attacker with network access over HTTP to send crafted requests that cause the Oracle WebCenter Content server to hang or crash, leading to a complete denial of service. It does not provide confidentiality or integrity compromise, but it can disrupt business operations by taking the application offline.

Affected Systems

Oracle Corporation’s WebCenter Content product is affected, specifically versions 12.2.1.4.0 and 14.1.2.0.0. No other products are listed as impacted.

Risk and Exploitability

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) assigns a score of 6.5, indicating moderate severity with significant impact on availability. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The exploit requires only network connectivity to the HTTP endpoint of the WebCenter Content server and can be performed by an attacker with no elevated privileges, making it relatively easy to execute within a network that can reach the target.

Generated by OpenCVE AI on October 21, 2026 at 08:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle WebCenter Content patch for versions 12.2.1.4.0 and 14.1.2.0.0 as published in the official CPU Oct 2026 advisory.
  • If immediate patching is not possible, configure the application firewall or reverse proxy to reject malformed HTTP requests and limit the rate of requests to the Content Server.
  • After applying the fix or implementing traffic controls, monitor the application logs for repeated crashes or abnormal error messages to verify the effectiveness of the mitigation.

Generated by OpenCVE AI on October 21, 2026 at 08:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 08:30:00 +0000

Type Values Removed Values Added
Title Denial of Service Vulnerability in Oracle WebCenter Content via Malformed HTTP Requests
Weaknesses CWE-400
CWE-770

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebCenter Content. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle webcenter Content
CPEs cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_content:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Content
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Webcenter Content
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:24:19.037Z

Reserved: 2026-09-08T21:49:12.414Z

Link: CVE-2026-87365

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:20:14.487

Modified: 2026-10-20T22:20:14.487

Link: CVE-2026-87365

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T08:15:09Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling