Description
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Full system compromise via remote HTTP access
Action: Immediate Patch
AI Analysis

Impact

This vulnerability enables a low‑privileged attacker with network connectivity over HTTP to take over an Oracle WebCenter Content installation. The attack merits full compromise of confidentiality, integrity, and availability, elevating the severity to a high CVSS 3.1 score of 7.5. The weakness is consistent with improper access control and lack of authorization enforcement. As a result, an attacker can execute arbitrary actions within the application, effectively acquiring full control of the affected instance.

Affected Systems

Affected products are Oracle WebCenter Content, including the 12.2.1.4.0 and 14.1.2.0.0 versions. These deployments are part of the Oracle Fusion Middleware stack and must be identified in your inventory.

Risk and Exploitability

The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) shows that traffic is sent over the open network, with high attack complexity and low required privileges. Although the EPSS score is not available, the high base score signals a significant risk. The vulnerability is not listed in the CISA KEV catalog, but its potential for complete takeover justifies urgent remediation.

Generated by OpenCVE AI on October 21, 2026 at 10:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle WebCenter Content patch that addresses CVE-2026-91504 as soon as it becomes available.
  • Limit HTTP exposure by restricting access to the WebCenter Content web tier to trusted IP ranges or internal networks until the patch is deployed.
  • Enable logging and monitoring of HTTP requests to the Content Portal to detect abnormal activity during the remediation window.
  • Review and tighten access controls and roles within WebCenter Content to minimize privileged access for ordinary users.

Generated by OpenCVE AI on October 21, 2026 at 10:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 24 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle Corporation
Oracle Corporation oracle Webcenter Content
Vendors & Products Oracle Corporation
Oracle Corporation oracle Webcenter Content

Wed, 21 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Title Remote Access Vulnerability Allowing Full Takeover of Oracle WebCenter Content
Weaknesses CWE-284
CWE-862

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle webcenter Content
CPEs cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_content:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Content
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Webcenter Content
Oracle Corporation Oracle Webcenter Content
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-24T03:42:12.377Z

Reserved: 2026-09-14T22:10:16.639Z

Link: CVE-2026-91504

cve-icon Vulnrichment

Updated: 2026-10-24T03:42:07.629Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:54.893

Modified: 2026-11-03T18:16:59.047

Link: CVE-2026-91504

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:45:08Z

Weaknesses