{"id":"CVE-2026-91495","kind":"vulnerability","aliases":["CVE-2026-91495"],"related":[],"title":"Oracle WebCenter Content: unauthenticated HTTP takeover of Content Server","description":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle WebCenter Content Server versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw that an unauthenticated attacker can reach over the network via HTTP. Successful exploitation gives the attacker full takeover of the product, with high confidentiality, integrity and availability impact.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle WebCenter Content","fixed":["October 2026 CPU patch (number in MOS)"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-fusion-middleware","oracle-webcenter-content","package","self-hosted","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":"Check whether you run Oracle WebCenter Content (Content Server) at 12.2.1.4.0 or 14.1.2.0.0 (e.g. 'opatch lsinventory' in the Oracle home, and check whether the Content Server HTTP port is reachable from untrusted networks). Confirm the October 2026 CPU patch is listed in the inventory. Oracle publishes no IOCs or workaround; until patched, restrict network access to Content Server.","fix":"Apply the October 2026 Critical Patch Update patch for Oracle WebCenter Content (Fusion Middleware) from My Oracle Support, via the Fusion Middleware Patch Availability Document linked from the CPU advisory. Exact patch number not public; needs MOS login.","status":"open","published_at":"2026-10-20T22:20:54+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:55+00:00","updated_at":"2026-10-23T22:56:15+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:33:55Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update fix for WebCenter Content (the sources do not name the patch or version).","reach":"internet","title":"Oracle WebCenter Content: unauthenticated HTTP takeover of Content Server","impact":"high","summary":"Oracle WebCenter Content Server versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw that an unauthenticated attacker can reach over the network via HTTP. Successful exploitation gives the attacker full takeover of the product, with high confidentiality, integrity and availability impact.","category":"vendor","who_cares":["oracle-webcenter-content","oracle-fusion-middleware","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over Content Server and reads or changes all stored content","analyst_note":"Find the Oracle Critical Patch Update advisory and the patched version numbers for 12.2.1.4.0 and 14.1.2.0.0, plus any mitigation or indicator-of-compromise guidance; check the NVD link for the Oracle advisory reference.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000542,"input_tokens":3092,"output_tokens":465,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory and the patched version numbers for 12.2.1.4.0 and 14.1.2.0.0, plus any mitigation or indicator-of-compromise guidance; check the NVD link for the Oracle advisory reference.","search":"'-2026':11A,14A '-91495':12A,15A '/av':137C '12.2.1.4.0':37B,91C '14.1.2.0.0':39B,93C '3.1':124C,136C '9.8':127C 'access':102C 'affect':89C 'allow':97C 'attack':46B,58B,99C,111C 'avail':69B,131C 'base':125C 'compon':82C 'compromis':106C 'confidenti':66B,128C 'contain':40B 'content':3A,8A,18A,26B,34B,76C,83C,109C,122C 'cve':10A,13A 'cvss':123C,133C,135C 'easili':94C 'exploit':55B,95C 'flaw':42B 'full':59B 'fusion':21B,80C 'give':56B 'h':145C 'h/a':144C 'h/i':143C 'high':65B 'host':30B 'http':5A,53B,104C 'impact':70B,132C 'integr':67B,129C 'l/pr':139C 'middlewar':22B,81C 'n/ac':138C 'n/s':141C 'n/ui':140C 'network':51B,101C 'oracl':1A,20B,24B,32B,74C,79C,107C,120C 'oracle':16A 'oracle-fusion-middlewar':19B 'oracle-webcenter-cont':23B 'packag':27B 'product':63B,77C 'reach':48B 'result':116C 'score':126C 'self':29B 'self-host':28B 'server':9A,35B,84C 'success':54B,110C 'support':85C 'takeov':6A,60B,118C 'u/c':142C 'unauthent':4A,45B,98C 'vector':134C 'vendor':31B 'version':36B,86C 'via':52B,103C 'vulner':71C,96C,114C 'webcent':2A,25B,33B,75C,108C,121C 'webcenter':17A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91495","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91495","severity":null,"published_at":"2026-10-20T22:20:54+00:00","modified_at":"2026-10-21T18:45:11+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91495:330","url":null,"severity":null,"published_at":"2026-10-23T22:56:15+00:00","modified_at":"2026-10-23T22:56:15+00:00","first_seen_at":"2026-10-23T22:56:15+00:00","fetched_at":"2026-10-23T22:56:15+00:00","note":"Oracle CPU Oct 2026 (20 Oct) is the primary advisory; fix is the Oct 2026 CPU patch via My Oracle Support. Page text I read was truncated before the WebCenter Content row, and the per-patch number/fixed version is behind MOS, so not read. No exploitation or PoC found (Armis says none reported as of 20 Oct; no X posts). Not in KEV per Armis."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1688,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91495","title":"CVE Record: CVE-2026-91495","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}