{"id":"CVE-2026-87390","kind":"vulnerability","aliases":["CVE-2026-87390"],"related":[],"title":"Oracle WebCenter Content: unauthenticated HTTP flaw allows partial data change and denial of service","description":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Content. CVSS 3.1 Base Score 5.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L).","summary":"Oracle WebCenter Content Server, part of Oracle Fusion Middleware, has a flaw reachable over HTTP without credentials. A successful attack, which needs a user to take an action, can change or delete some accessible data and partly disrupt the service.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle-fusion-middleware","oracle-webcenter-content","package","self-hosted"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed WebCenter Content version against `12.2.1.4.0` and `14.1.2.0.0`, the affected releases named in the description.","fix":null,"status":"open","published_at":"2026-10-20T22:20:17+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:14:55+00:00","updated_at":"2026-10-25T04:14:55+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:14:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle WebCenter Content: unauthenticated HTTP flaw allows partial data change and denial of service","impact":"medium","summary":"Oracle WebCenter Content Server, part of Oracle Fusion Middleware, has a flaw reachable over HTTP without credentials. A successful attack, which needs a user to take an action, can change or delete some accessible data and partly disrupt the service.","category":"package","nicknames":[],"who_cares":["oracle-webcenter-content","oracle-fusion-middleware","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Some content data altered or deleted, and partial service denial","analyst_note":"Find the Oracle Critical Patch Update advisory that lists the fix version for CVE-2026-87390 and confirm the patched releases.","how_to_check":"- Check the installed WebCenter Content version against `12.2.1.4.0` and `14.1.2.0.0`, the affected releases named in the description.","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Deployments of Oracle WebCenter Content Server in the affected versions 12.2.1.4.0 and 14.1.2.0.0 that are reachable over HTTP. The sources do not say which configurations or patches apply, so teams on other versions can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000611,"input_tokens":3537,"output_tokens":514,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-87390':17A,20A '/av':175C '12.2.1.4.0':93C '14.1.2.0.0':95C '3.1':163C,174C '5.4':166C 'abil':148C 'access':66B,104C,137C,144C 'action':60B 'affect':91C 'allow':7A,99C 'attack':52B,101C,113C,123C,125C 'avail':169C 'base':164C 'caus':150C 'chang':10A,62B 'compon':84C 'compromis':108C 'content':3A,28B,35B,78C,85C,111C,143C,161C 'credenti':49B 'cve':15A,18A 'cvss':162C,171C,173C 'data':9A,67B,145C 'delet':64B,136C 'denial':12A,153C 'disrupt':70B 'dos':157C 'easili':96C 'exploit':97C 'flaw':6A,44B 'fusion':23B,40B,82C 'host':32B 'http':5A,47B,106C 'human':115C 'impact':170C 'insert':134C 'integr':167C 'interact':116C 'l':183C 'l/a':182C 'l/pr':177C 'middlewar':24B,41B,83C 'n/ac':176C 'n/i':181C 'n/ui':178C 'need':54B 'network':103C 'oracl':1A,22B,26B,33B,39B,76C,81C,109C,141C,159C 'oracle-fusion-middlewar':21B 'oracle-webcenter-cont':25B 'packag':29B 'part':37B,69B 'partial':8A,152C,156C 'person':119C 'product':79C 'r/s':179C 'reachabl':45B 'requir':114C 'result':130C 'score':165C 'self':31B 'self-host':30B 'server':36B,86C 'servic':14A,72B,155C 'success':51B,112C,124C 'support':87C 'take':58B 'u/c':180C 'unauthent':4A,100C 'unauthor':132C,147C 'updat':133C 'user':56B 'vector':172C 'version':88C 'via':105C 'vulner':73C,98C,128C 'webcent':2A,27B,34B,77C,110C,142C,160C 'without':48B","nicknames":[],"mitigations":[],"who_affected":"Deployments of Oracle WebCenter Content Server in the affected versions 12.2.1.4.0 and 14.1.2.0.0 that are reachable over HTTP. The sources do not say which configurations or patches apply, so teams on other versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87390","severity":null,"published_at":"2026-10-20T22:20:17+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}