Description
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N).
Published: 2026-10-20
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized modification and read of critical data
Action: Patch Immediately
AI Analysis

Impact

The vulnerability in Oracle WebCenter Content 14.1.2.0.0 allows a low‑privileged attacker with network access via HTTP to manipulate content data. Exploitation requires a second human user to interact, but once activated, the attacker can create, delete, modify, or read critical content. The flaw enables unauthorized changes to data integrity and confidentiality without affecting availability.

Affected Systems

Oracle WebCenter Content (Oracle Fusion Middleware) version 14.1.2.0.0 is the only affected release reported. The issue resides in the Content Server component.

Risk and Exploitability

The CVSS 3.1 score of 6.3 indicates a moderate severity with Confidentiality and Integrity impacts. EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is a network path over HTTP from a low‑privileged attacker; the requirement for a human interaction limits the ease of exploitation but does not eliminate the risk of successful compromise.

Generated by OpenCVE AI on October 28, 2026 at 20:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for WebCenter Content 14.1.2.0.0 as released in the security advisory.
  • Restrict HTTP access to the Content Server to trusted IP ranges or VPN only to reduce the attack surface.
  • Enforce rigorous access controls and audit trails for content modification operations to detect and deter unauthorized activity.

Generated by OpenCVE AI on October 28, 2026 at 20:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Access Vulnerability in Oracle WebCenter Content Allowing Low‑Privileged Attackers to Modify or Read Critical Data

Wed, 28 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Title Oracle WebCenter Content Vulnerability Allowing Low-Privilege Attacker to Manipulate Content via HTTP
Weaknesses CWE-285

Wed, 28 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Oracle Corporation
Oracle Corporation oracle Webcenter Content
Vendors & Products Oracle Corporation
Oracle Corporation oracle Webcenter Content

Wed, 21 Oct 2026 08:00:00 +0000

Type Values Removed Values Added
Title Oracle WebCenter Content Vulnerability Allowing Low-Privilege Attacker to Manipulate Content via HTTP
Weaknesses CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N).
First Time appeared Oracle
Oracle webcenter Content
CPEs cpe:2.3:a:oracle:webcenter_content:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Content
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N'}

Subscriptions

Oracle Webcenter Content
Oracle Corporation Oracle Webcenter Content
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T16:44:27.342Z

Reserved: 2026-09-08T21:49:12.416Z

Link: CVE-2026-87399

cve-icon Vulnrichment

Updated: 2026-10-28T16:44:22.024Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:18.337

Modified: 2026-11-03T17:17:23.500

Link: CVE-2026-87399

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T21:00:23Z

Weaknesses