Oracle WebCenter Content CVE-2026-87371

Requires the attacker to be positioned on the same physical communication segment / adjacent network (AV:A) as the host executing Oracle WebCenter Content - not reachable from arbitrary remote Internet locations - which is the primary limiting factor. Exploitation additionally demands satisfying High-complexity conditions (AC:H): specific timing, state, or environmental circumstances the attacker cannot fully control, reducing reliability. No authentication is required (PR:N) and no user interaction is needed (UI:N). Affected deployments are specifically the Content Server component of WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0; successful attacks impact confidentiality and integrity of WebCenter-accessible data but not availability.

This is a moderate-severity (CVSS 3.1 6.8) vulnerability whose real-world risk is substantially constrained by its attack vector. The vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N confirms the attacker needs Adjacent-network access (AV:A) - per Oracle's description, access to the physical communication segment attached to the hardware running WebCenter Content - rather than full remote Internet reachability, and must overcome High attack complexity (AC:H), implying specific timing, state, or configuration conditions outside the attacker's control. These two factors are the dominant risk-reducers. Offsetting them, exploitation requires no authentication (PR:N) and no user interaction (UI:N), and a successful attack yields High confidentiality and High integrity impact (C:H/I:H) over all WebCenter Content accessible data, with no availability impact (A:N). No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization - this appears to be a vendor-reported (Oracle secalert) issue disclosed via the October 2026 Critical Patch Update. Net assessment: this is a patch-in-normal-cycle issue for most organizations, elevated only where WebCenter Content hosts highly sensitive content AND the network segment is exposed to untrusted adjacent hosts; the AV:A + AC:H combination makes opportunistic mass exploitation unlikely. Note: the input Tag 'Authentication Bypass' is not corroborated by the description, which characterizes the flaw as unauthenticated adjacent-network data compromise rather than a bypass of an authentication control - treat that tag with caution.

An attacker who has gained a foothold on a host sharing the same physical/logical network segment as the Oracle WebCenter Content server (e.g., a compromised adjacent server or a rogue device on the data-center VLAN) sends crafted traffic to the Content Server component and, by meeting specific high-complexity timing or state conditions, reads or modifies critical managed content without authenticating. No public exploit code was identified at time of analysis, and the high attack complexity means reliable exploitation is non-trivial.