Oracle WebCenter Content CVE-2026-87360

Exploitation requires (1) network/HTTP reachability to the Oracle WebCenter Content Content Server component, and (2) human interaction from a person other than the attacker (UI:R) - the attacker cannot act alone and must induce an authorized user to perform some action. The high attack complexity (AC:H) indicates additional conditions beyond the attacker's control (such as timing, specific server state, or a non-trivial setup) must be met. Affected deployments are specifically versions 12.2.1.4.0 and 14.1.2.0.0; other versions are not listed as vulnerable. No authentication is required (PR:N). These limiting factors - mandatory victim interaction plus high complexity - substantially constrain reliable mass exploitation despite the network, unauthenticated vector.

This is a moderate-priority issue that scores below its headline confidentiality impact because of real exploitation friction. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.3) shows a remote, network-reachable flaw requiring no authentication, but two factors suppress real-world risk: high attack complexity (AC:H) and required user interaction from a person other than the attacker (UI:R), meaning the attacker must reliably win a race, condition, or trick a victim into an action. Impact is confidentiality-only (C:H, I:N, A:N) - disclosure of critical WebCenter Content data with no integrity or availability loss. No EPSS score, CISA KEV listing, SSVC decision data, or POC is present in the input, so there is no signal of active or imminent exploitation; absence of these is not evidence of safety but does argue against widespread automated attack. On balance this reads as a high-CVSS- by-category but constrained-in-practice issue: patch within normal Oracle CPU cadence rather than emergency. Note a conflict to verify: the input Tags label this 'Authentication Bypass,' yet the description and vector describe an unauthenticated, user-interaction-dependent data-disclosure bug, not a bypass of an authentication control - treat the tag as unverified.

An unauthenticated attacker crafts a malicious link or content payload targeting an internet-reachable Oracle WebCenter Content Server and lures an authorized user into interacting with it (e.g., opening a crafted URL). The difficult-to-exploit condition and required victim interaction mean success is not guaranteed, but a successful attack discloses critical or all WebCenter Content accessible data to the attacker. No public exploit code is identified in the provided data.