{"id":"CVE-2026-87361","kind":"vulnerability","aliases":["CVE-2026-87361"],"related":[],"title":"Oracle WebCenter Content: low-privilege HTTP user can alter some stored data","description":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).","summary":"Oracle WebCenter Content Server 12.2.1.4.0 has a flaw that lets a low-privileged user reach the server over HTTP and make unauthorized updates, inserts or deletes to some accessible content. The CVSS 3.1 score is 4.3 with only integrity impact, so confidentiality and availability are not listed as affected.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle-fusion-middleware","oracle-webcenter-content","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Confirm the deployed Content Server version is `12.2.1.4.0` (check the Oracle Fusion Middleware or WebCenter Content installation or patch inventory)\n- unknown","fix":"- Apply the Oracle Critical Patch Update fix for WebCenter Content Server that covers this CVE; the sources do not name the patched version or patch number\n- unknown","status":"open","published_at":"2026-10-20T22:20:14+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:39:07+00:00","updated_at":"2026-10-25T04:39:07+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:39:07Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for WebCenter Content Server that covers this CVE; the sources do not name the patched version or patch number\n- unknown","reach":"network","title":"Oracle WebCenter Content: low-privilege HTTP user can alter some stored data","impact":"medium","summary":"Oracle WebCenter Content Server 12.2.1.4.0 has a flaw that lets a low-privileged user reach the server over HTTP and make unauthorized updates, inserts or deletes to some accessible content. The CVSS 3.1 score is 4.3 with only integrity impact, so confidentiality and availability are not listed as affected.","category":"vendor","nicknames":[],"who_cares":["oracle-webcenter-content","oracle-fusion-middleware","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Low-privileged users can alter or delete some stored content","analyst_note":"Find the Oracle Security Alert or CPU advisory for CVE-2026-87361 to get the patched version, patch number and any non-default configuration requirement.","how_to_check":"- Confirm the deployed Content Server version is `12.2.1.4.0` (check the Oracle Fusion Middleware or WebCenter Content installation or patch inventory)\n- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running Oracle WebCenter Content Server version 12.2.1.4.0 that accept HTTP requests from low-privileged users. The sources do not say which configurations or features are required, so other versions and deployments are not confirmed affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000648,"input_tokens":3460,"output_tokens":604,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-87361':16A,19A '/av':154C '12.2.1.4.0':36B,103C '3.1':65B,144C,153C '4.3':68B,147C 'access':61B,113C,134C,141C 'affect':81B,101C 'allow':107C 'alter':10A 'attack':110C,122C 'avail':76B 'base':145C 'compon':93C 'compromis':117C 'confidenti':74B 'content':3A,27B,34B,62B,87C,94C,120C,140C 'cve':14A,17A 'cvss':64B,143C,150C,152C 'data':13A,142C 'delet':58B,133C 'easili':104C 'exploit':105C 'flaw':39B 'fusion':22B,91C 'host':30B 'http':7A,51B,115C 'impact':72B,149C 'insert':56B,131C 'integr':71B,148C 'l/a':161C 'l/pr':156C 'l/ui':157C 'let':41B 'list':79B 'low':5A,44B,108C 'low-privileg':4A,43B 'make':53B 'middlewar':23B,92C 'n':162C 'n/ac':155C 'n/i':160C 'n/s':158C 'network':112C 'oracl':1A,21B,25B,32B,85C,90C,118C,138C 'oracle-fusion-middlewar':20B 'oracle-webcenter-cont':24B 'privileg':6A,45B,109C 'product':88C 'reach':47B 'result':127C 'score':66B,146C 'self':29B 'self-host':28B 'server':35B,49B,95C 'store':12A 'success':121C 'support':97C 'u/c':159C 'unauthor':54B,129C 'updat':55B,130C 'user':8A,46B 'vector':151C 'vendor':31B 'version':98C 'via':114C 'vulner':82C,106C,125C 'webcent':2A,26B,33B,86C,119C,139C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle WebCenter Content Server version 12.2.1.4.0 that accept HTTP requests from low-privileged users. The sources do not say which configurations or features are required, so other versions and deployments are not confirmed affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87361","severity":null,"published_at":"2026-10-20T22:20:14+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}