Oracle WebCenter Content CVE-2026-87370

Exploitation requires the attacker to already possess a valid low-privileged account on Oracle WebCenter Content (PR:L) with HTTP network reachability to the Content Server component, AND requires a second human - a person other than the attacker (UI:R) - to perform an interaction, implying a social-engineering or lure step against a more privileged user. Oracle explicitly rates this as 'difficult to exploit' (AC:H), indicating dependence on specific timing, state, or non-trivial preconditions rather than a single deterministic request. Affected deployments are limited to WebCenter Content 12.2.1.4.0 and 14.1.2.0.0. The scope change (S:C) means a successful attack can impact products beyond WebCenter Content. Key limiting factors for defenders: valid credentials are mandatory, a cooperating/duped victim is mandatory, and high complexity reduces reliability - so patch prioritization can trail unauthenticated, no-interaction flaws.

This is a moderate-priority issue that the raw CVSS 3.1 base score of 6.5 (MEDIUM) describes fairly, and the vector argues against treating it as a drop-everything emergency. Multiple friction factors stack up: AC:H (high attack complexity, i.e. 'difficult to exploit' per Oracle), PR:L (the attacker must already hold a valid low-privileged account), and UI:R (success requires a separate human victim to interact). The only elevating signals are AV:N (reachable over HTTP) and S:C (scope change - Oracle states attacks 'may significantly impact additional products'), which pushes the effective blast radius beyond WebCenter Content itself. Impact is skewed to confidentiality (C:H - full read of WebCenter Content data) with limited integrity (I:L) and no availability loss (A:N). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or at-scale exploitation; the combination of AC:H + PR:L + UI:R is consistent with low near-term mass-exploitation likelihood and favors targeted scenarios over opportunistic scanning. Note a metadata conflict: the input Tag 'Authentication Bypass' contradicts the CVSS vector, which requires PR:L (an authenticated low-privileged attacker) - this is not an unauthenticated bypass, so that tag should be treated with suspicion and verified against the Oracle advisory.

An attacker who already holds a low-privileged WebCenter Content account crafts malicious content or a link and lures a second, more privileged user into interacting with it over HTTP. Because the attack requires difficult-to-arrange conditions (AC:H) and victim interaction (UI:R), it is better suited to a targeted phishing/social-engineering operation than broad opportunistic scanning. No public exploit code was identified at time of analysis, so weaponization would require original development.