{"id":"CVE-2026-87392","kind":"vulnerability","aliases":["CVE-2026-87392"],"related":[],"title":"Oracle WebCenter Content: Imaging flaw lets low-privilege users modify data via SOAP","description":"Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise WebCenter Content: Imaging.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).","summary":"Oracle WebCenter Content: Imaging 14.1.2.0.0 has a flaw in its Core component that is reachable over SOAP. An attacker with a low-privilege account on the network can create, change or delete data the product can access.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fusion-middleware","imaging","oracle","runtime","soap","webcenter-content"],"not_affected_if":["not-running-webcenter-imaging"],"how_to_check":"- Confirm the installed version of Oracle WebCenter Content: Imaging is `14.1.2.0.0` (unknown how to read it from the sources)\n- Check whether the SOAP endpoint of the product is reachable from untrusted networks (unknown from the sources)","fix":"- Apply the Oracle Critical Patch Update fix for WebCenter Content: Imaging referenced in the NVD entry (unknown patch version from the sources)","status":"open","published_at":"2026-10-20T22:20:17+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:51:11+00:00","updated_at":"2026-10-25T03:51:11+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:51:11Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for WebCenter Content: Imaging referenced in the NVD entry (unknown patch version from the sources)","reach":"network","title":"Oracle WebCenter Content: Imaging flaw lets low-privilege users modify data via SOAP","impact":"medium","summary":"Oracle WebCenter Content: Imaging 14.1.2.0.0 has a flaw in its Core component that is reachable over SOAP. An attacker with a low-privilege account on the network can create, change or delete data the product can access.","category":"runtime","nicknames":[],"who_cares":["oracle","webcenter-content","imaging","soap","fusion-middleware"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker modifies or deletes critical imaging data","analyst_note":"Find the Oracle Critical Patch Update advisory for the fixed version and confirm the SOAP endpoint exposure, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-87392.","how_to_check":"- Confirm the installed version of Oracle WebCenter Content: Imaging is `14.1.2.0.0` (unknown how to read it from the sources)\n- Check whether the SOAP endpoint of the product is reachable from untrusted networks (unknown from the sources)","needs_analyst":true,"not_affected_if":["not-running-webcenter-imaging"],"who_is_affected":"Organizations running Oracle WebCenter Content: Imaging 14.1.2.0.0 with the SOAP interface reachable by users who hold a low-privilege account. Teams not running this product can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000654,"input_tokens":3465,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-87392':17A,20A '/av':142C '14.1.2.0.0':35B,89C '3.1':132C,141C '6.5':135C 'access':68B,99C,120C,129C 'account':55B 'affect':87C 'allow':93C 'attack':49B,96C,108C 'base':133C 'chang':61B 'compon':42B,80C 'compromis':103C 'content':3A,30B,33B,73C,105C,127C 'core':41B,81C 'creat':60B 'creation':116C 'critic':122C 'cve':15A,18A 'cvss':131C,138C,140C 'data':12A,64B,123C,130C 'delet':63B,117C 'easili':90C 'exploit':91C 'flaw':5A,38B 'fusion':22B,78C 'fusion-middlewar':21B 'h/a':149C 'imag':4A,24B,34B,74C,106C,128C 'impact':137C 'integr':136C 'l/pr':144C 'l/ui':145C 'let':6A 'low':8A,53B,94C 'low-privileg':7A,52B 'middlewar':23B,79C 'modif':119C 'modifi':11A 'n':150C 'n/ac':143C 'n/i':148C 'n/s':146C 'network':58B,98C 'oracl':1A,25B,31B,77C 'privileg':9A,54B,95C 'product':66B,75C 'reachabl':45B 'result':113C 'runtim':26B 'score':134C 'soap':14A,27B,47B,101C 'success':107C 'support':83C 'u/c':147C 'unauthor':115C 'user':10A 'vector':139C 'version':84C 'via':13A,100C 'vulner':69C,92C,111C 'webcent':2A,29B,32B,72C,104C,126C 'webcenter-cont':28B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle WebCenter Content: Imaging 14.1.2.0.0 with the SOAP interface reachable by users who hold a low-privilege account. Teams not running this product can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87392","severity":null,"published_at":"2026-10-20T22:20:17+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}