---
id: "CVE-2026-87361"
kind: "vulnerability"
aliases: ["CVE-2026-87361"]
title: "Oracle WebCenter Content: low-privilege HTTP user can alter some stored data"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["oracle-fusion-middleware", "oracle-webcenter-content", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T22:20:14+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T04:39:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87361", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle WebCenter Content: low-privilege HTTP user can alter some stored data

Oracle WebCenter Content Server 12.2.1.4.0 has a flaw that lets a low-privileged user reach the server over HTTP and make unauthorized updates, inserts or deletes to some accessible content. The CVSS 3.1 score is 4.3 with only integrity impact, so confidentiality and availability are not listed as affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the deployed Content Server version is `12.2.1.4.0` (check the Oracle Fusion Middleware or WebCenter Content installation or patch inventory)
- unknown

## Fix

- Apply the Oracle Critical Patch Update fix for WebCenter Content Server that covers this CVE; the sources do not name the patched version or patch number
- unknown

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87361

## From the sources

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_