Oracle WebCenter Content CVE-2026-87299

Exploitation requires human interaction from a victim other than the attacker (CVSS UI:R) - a logged-in or targeted WebCenter Content user must click or render attacker-supplied content delivered over HTTP; the attacker needs no authentication (PR:N) but cannot trigger the flaw unattended. Limiting factors: the dependence on a victim's action makes automated mass exploitation impractical, and impact is bounded to limited (low) confidentiality and integrity with no availability effect. Applies to default-reachable HTTP interfaces of Content Server on Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0; the scope change (S:C) means successful attacks may affect additional products beyond WebCenter Content itself.

This is a moderate-severity issue (CVSS 3.1 base 6.1) that should be prioritized as routine patching rather than an emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) describes a network-reachable, low-complexity, unauthenticated flaw - but the mandatory user interaction (UI:R), scope change (S:C), limited confidentiality/integrity impact (C:L/I:L) and absence of availability impact (A:N) are the classic fingerprint of a cross-site scripting (XSS) / client-side injection flaw, not server-side code execution. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active or imminent exploitation; the signals are internally consistent (network vector tempered by required victim interaction) and point to targeted social-engineering rather than mass automated exploitation. Note the input Tag 'Authentication Bypass' conflicts with the description and CVSS profile, which describe an interaction-driven data-access flaw with no authentication-bypass behavior - treat that tag as suspect. Overall: a real but non-critical issue; apply the October 2026 CPU on a normal cycle.

An attacker crafts a malicious HTTP request or link targeting the Oracle WebCenter Content Server and lures a logged-in user into opening it; because exploitation requires interaction from a victim other than the attacker, no POC is known and the attacker cannot act fully autonomously. When the victim interacts, injected content runs in their session context, letting the attacker read a subset of accessible data and perform limited unauthorized update/insert/delete operations, with effects potentially crossing into additional products (scope change).