{"id":"CVE-2026-87377","kind":"vulnerability","aliases":["CVE-2026-87377"],"related":[],"title":"Oracle WebCenter Content Imaging: low-privileged SOAP user can read and change data","description":"Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).   The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via SOAP to compromise WebCenter Content: Imaging.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all WebCenter Content: Imaging accessible data as well as  unauthorized access to critical data or complete access to all WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).","summary":"A flaw in the Core component of Oracle WebCenter Content Imaging 14.1.2.0.0 lets a low-privileged user reach the product over SOAP and gain unauthorized access to data. An attacker can create, delete or modify critical data and read all data the product can access, though exploitation is difficult.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fusion-middleware","oracle","self-hosted","soap","vendor","webcenter-content"],"not_affected_if":["no-soap-exposure","other-version"],"how_to_check":"- Confirm the installed version is `14.1.2.0.0` in the WebCenter Content Imaging admin console or deployment record\n- Check whether the SOAP endpoint of WebCenter Content Imaging is reachable from untrusted networks","fix":"- Apply the Oracle Critical Patch Update fix for WebCenter Content Imaging 14.1.2.0.0 (version to move to: unknown, see Oracle advisory)","status":"open","published_at":"2026-10-20T22:20:15+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:43:07+00:00","updated_at":"2026-10-25T03:43:07+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:43:07Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for WebCenter Content Imaging 14.1.2.0.0 (version to move to: unknown, see Oracle advisory)","reach":"network","title":"Oracle WebCenter Content Imaging: low-privileged SOAP user can read and change data","impact":"medium","summary":"A flaw in the Core component of Oracle WebCenter Content Imaging 14.1.2.0.0 lets a low-privileged user reach the product over SOAP and gain unauthorized access to data. An attacker can create, delete or modify critical data and read all data the product can access, though exploitation is difficult.","category":"vendor","nicknames":[],"who_cares":["oracle","webcenter-content","fusion-middleware","soap","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads, creates, changes or deletes data across the product","analyst_note":"Check the Oracle Security Alert advisory for the patch version and whether SOAP is enabled by default; sources here give no fixed version.","how_to_check":"- Confirm the installed version is `14.1.2.0.0` in the WebCenter Content Imaging admin console or deployment record\n- Check whether the SOAP endpoint of WebCenter Content Imaging is reachable from untrusted networks","needs_analyst":true,"not_affected_if":["other-version","no-soap-exposure"],"who_is_affected":"Only deployments of Oracle WebCenter Content Imaging 14.1.2.0.0 are listed as affected. Exposure depends on whether low-privileged accounts exist and whether the SOAP interface is reachable by them. Teams not running this product can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000663,"input_tokens":3509,"output_tokens":625,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-87377':17A,20A '/av':177C '14.1.2.0.0':44B,103C '3.1':165C,176C '6.8':168C 'access':59B,78B,114C,135C,144C,150C,156C,162C 'affect':101C 'allow':108C 'attack':63B,111C,123C 'base':166C 'chang':13A 'complet':155C 'compon':38B,94C 'compromis':118C 'confidenti':169C 'content':3A,32B,42B,87C,120C,142C,160C 'core':37B,95C 'creat':65B 'creation':131C 'critic':69B,137C,152C 'cve':15A,18A 'cvss':164C,173C,175C 'data':14A,61B,70B,74B,138C,145C,153C,163C 'delet':66B,132C 'difficult':82B,104C 'exploit':80B,106C 'flaw':34B 'fusion':22B,92C 'fusion-middlewar':21B 'gain':57B 'h/a':184C 'h/i':183C 'h/pr':179C 'host':27B 'imag':4A,43B,88C,121C,143C,161C 'impact':172C 'integr':171C 'l/ui':180C 'let':45B 'low':6A,48B,109C 'low-privileg':5A,47B 'middlewar':23B,93C 'modif':134C 'modifi':68B 'n':185C 'n/ac':178C 'n/s':181C 'network':113C 'oracl':1A,24B,40B,91C 'privileg':7A,49B,110C 'product':53B,76B,89C 'reach':51B 'read':11A,72B 'result':128C 'score':167C 'self':26B 'self-host':25B 'soap':8A,28B,55B,116C 'success':122C 'support':97C 'though':79B 'u/c':182C 'unauthor':58B,130C,149C 'user':9A,50B 'vector':174C 'vendor':29B 'version':98C 'via':115C 'vulner':83C,107C,126C 'webcent':2A,31B,41B,86C,119C,141C,159C 'webcenter-cont':30B 'well':147C","nicknames":[],"mitigations":[],"who_affected":"Only deployments of Oracle WebCenter Content Imaging 14.1.2.0.0 are listed as affected. Exposure depends on whether low-privileged accounts exist and whether the SOAP interface is reachable by them. Teams not running this product can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87377","severity":null,"published_at":"2026-10-20T22:20:15+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}