---
id: "CVE-2026-91495"
kind: "vulnerability"
aliases: ["CVE-2026-91495"]
title: "Oracle WebCenter Content: unauthenticated HTTP takeover of Content Server"
severity: "critical"
cvss: 9.8
epss: 0.0045
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle WebCenter Content", "fixed": ["October 2026 CPU patch (number in MOS)"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["oracle-fusion-middleware", "oracle-webcenter-content", "package", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-20T22:20:54+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91495", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:56:15+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91495", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle WebCenter Content: unauthenticated HTTP takeover of Content Server

Oracle WebCenter Content Server versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw that an unauthenticated attacker can reach over the network via HTTP. Successful exploitation gives the attacker full takeover of the product, with high confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle WebCenter Content affected 12.2.1.4.0, 14.1.2.0.0 fixed October 2026 CPU patch (number in MOS)

## How to check

Check whether you run Oracle WebCenter Content (Content Server) at 12.2.1.4.0 or 14.1.2.0.0 (e.g. 'opatch lsinventory' in the Oracle home, and check whether the Content Server HTTP port is reachable from untrusted networks). Confirm the October 2026 CPU patch is listed in the inventory. Oracle publishes no IOCs or workaround; until patched, restrict network access to Content Server.

## Fix

Apply the October 2026 Critical Patch Update patch for Oracle WebCenter Content (Fusion Middleware) from My Oracle Support, via the Fusion Middleware Patch Availability Document linked from the CPU advisory. Exact patch number not public; needs MOS login.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91495
- 2026-10-23T22:56:15+00:00 analyst — Oracle CPU Oct 2026 (20 Oct) is the primary advisory; fix is the Oct 2026 CPU patch via My Oracle Support. Page text I read was truncated before the WebCenter Content row, and the per-patch number/fixed version is behind MOS, so not read. No exploitation or PoC found (Armis says none reported as of 20 Oct; no X posts). Not in KEV per Armis.
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91495

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91495 https://www.cve.org/CVERecord?id=CVE-2026-91495

## From the sources

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_