{"id":"CVE-2026-87391","kind":"vulnerability","aliases":["CVE-2026-87391"],"related":[],"title":"Oracle WebCenter Content Imaging: local high-privilege flaw exposes stored data","description":"Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where WebCenter Content: Imaging executes to compromise WebCenter Content: Imaging.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in WebCenter Content: Imaging, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N).","summary":"Oracle WebCenter Content: Imaging versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Core component. An attacker who already holds high privileges and a logon on the host can reach critical data in the product and, with user interaction, affect other products.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fusion-middleware","oracle","package","self-hosted","webcenter-content"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed WebCenter Content: Imaging version against `12.2.1.4.0` and `14.1.2.0.0`\n- Confirm which accounts can log on to the hosts running WebCenter Content: Imaging","fix":"- Apply the Oracle Critical Patch Update for WebCenter Content: Imaging (the sources do not name the fixed build: unknown)\n- Restrict logon to the WebCenter Content: Imaging hosts to administrators","status":"open","published_at":"2026-10-20T22:20:17+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:12:12+00:00","updated_at":"2026-10-25T04:12:12+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:12:12Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for WebCenter Content: Imaging (the sources do not name the fixed build: unknown)\n- Restrict logon to the WebCenter Content: Imaging hosts to administrators","reach":"local","title":"Oracle WebCenter Content Imaging: local high-privilege flaw exposes stored data","impact":"medium","summary":"Oracle WebCenter Content: Imaging versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Core component. An attacker who already holds high privileges and a logon on the host can reach critical data in the product and, with user interaction, affect other products.","category":"package","nicknames":[],"who_cares":["oracle","webcenter-content","fusion-middleware","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads critical data stored in WebCenter Content: Imaging","analyst_note":"","how_to_check":"- Check the installed WebCenter Content: Imaging version against `12.2.1.4.0` and `14.1.2.0.0`\n- Confirm which accounts can log on to the hosts running WebCenter Content: Imaging","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Deployments of Oracle WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0 where users with high privileges can log on to the host. The sources describe a local attack that needs a second person to act, so internet-only deployments with no local logon are less exposed. unknown for other versions.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000651,"input_tokens":3552,"output_tokens":592,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-87391':15A,18A '/av':179C '12.2.1.4.0':35B,91C '14.1.2.0.0':37B,93C '3.1':169C,178C '5.5':172C 'access':154C,160C,166C 'addit':141C 'affect':69B,89C 'allow':97C 'alreadi':48B 'attack':46B,100C,117C,127C,137C,146C 'base':170C 'c/c':184C 'chang':144C 'complet':159C 'compon':44B,83C 'compromis':112C 'confidenti':173C 'contain':38B 'content':3A,29B,32B,76C,108C,114C,135C,164C 'core':43B,84C 'critic':60B,156C 'cve':13A,16A 'cvss':168C,175C,177C 'data':12A,61B,157C,167C 'easili':94C 'execut':110C 'exploit':95C 'expos':10A 'flaw':9A,40B 'fusion':20B,81C 'fusion-middlewar':19B 'h/i':185C 'h/ui':182C 'high':7A,50B,98C 'high-privileg':6A 'hold':49B 'host':26B,57B 'human':119C 'imag':4A,33B,77C,109C,115C,136C,165C 'impact':140C,174C 'infrastructur':105C 'interact':68B,120C 'l/ac':180C 'l/pr':181C 'local':5A 'logon':54B,102C 'may':138C 'middlewar':21B,82C 'n':187C 'n/a':186C 'oracl':1A,22B,30B,80C 'packag':23B 'person':123C 'privileg':8A,51B,99C 'product':64B,71B,78C,142C 'r/s':183C 'reach':59B 'requir':118C 'result':151C 'scope':143C 'score':171C 'self':25B 'self-host':24B 'signific':139C 'store':11A 'success':116C,145C 'support':85C 'unauthor':153C 'user':67B 'vector':176C 'version':34B,86C 'vulner':72C,96C,131C,149C 'webcent':2A,28B,31B,75C,107C,113C,134C,163C 'webcenter-cont':27B","nicknames":[],"mitigations":[],"who_affected":"Deployments of Oracle WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0 where users with high privileges can log on to the host. The sources describe a local attack that needs a second person to act, so internet-only deployments with no local logon are less exposed. unknown for other versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87391","severity":null,"published_at":"2026-10-20T22:20:17+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}