CVE-2026-87372

Oracle Webcenter Content: information disclosure

Risk score: 40/100
CVSS: 6.5 v3.1
Exploit chance (30 days): 0.2%
Published: 20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle WebCenter Content executes to …
Affected: Oracle Webcenter Content
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Oracle Webcenter Content: Amber, patch this week. A critical vulnerability in Oracle WebCenter Content allows an unauthenticated attacker to compromise the product via HTTP, potentially leading to takeover.

The flaws

CVE-2026-87372: Information disclosure (CVSS 6.5 · EPSS 0%)
CVE-2026-91495: Authentication bypass (CVSS 9.8 · EPSS 0%)
CVE-2026-91504: Access control flaw (CVSS 7.5 · EPSS 0%)
CVE-2026-87365: Information disclosure can lead to denial of service (CVSS 6.5 · EPSS 0%)

The fix

Fix: Check the linked advisory for the concrete fix.

Who is exposed: {'products': ['Oracle WebCenter Content'], 'packages': [], 'versions': ['12.2.1.4.0', '14.1.2.0.0']}

Where it stands

No known exploitation

Connects to

Same weakness: Information disclosure (CWE-200). 358 other warnings in 30 days
Same product: Earlier Oracle Webcenter Content warnings. 14 in the last 90 days

Why it is Yellow

CVSS 6.5 medium

References

https://www.oracle.com/security-alerts/cpuoct2026.html

Original description

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle WebCenter Content executes to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Last activity 20 Oct 2026. Patch Forecast updates every hour.