Oracle WebCenter Content CVE-2026-87374

Exploitation requires an attacker to already possess a valid low-privileged account on Oracle WebCenter Content (PR:L) and network HTTP access to the Content Server component; it is not remotely unauthenticated. The high attack complexity (AC:H) indicates additional non-default or race/condition-dependent factors must be satisfied that are outside the attacker's direct control, making reliable exploitation difficult. No user interaction is needed (UI:N). Affected deployments are limited to Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. The combination of required authentication and high complexity are the primary limiting factors reducing realistic risk below the raw base score.

This is a mid-severity issue (CVSS 3.1 base 6.8) whose real-world priority is tempered by several limiting factors in the vector itself. While the attack vector is network (AV:N) over HTTP, the vulnerability carries high attack complexity (AC:H) and requires an already-authenticated low-privileged account (PR:L), meaning an attacker must first obtain valid credentials and then overcome non-trivial conditions to succeed. Impact is significant where it lands - high confidentiality and high integrity (C:H/I:H) with no availability impact (A:N) - allowing unauthorized read, creation, deletion or modification of all WebCenter Content-accessible data within an unchanged scope (S:U). No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no exploitation-probability or active-exploitation signal to corroborate urgency; at time of analysis there is no public exploit identified. The combination of AC:H plus PR:L strongly suggests this is an authenticated, hard-to-exploit flaw rather than a mass-exploitable internet-facing threat, so it ranks below default-config unauthenticated RCEs. Note a tag conflict: the input Tags include 'Authentication Bypass', which contradicts the CVSS PR:L and the description (a low-privileged attacker is required, not an authentication bypass) - verify the classification with Oracle's advisory.

An attacker who already holds a low-privileged WebCenter Content account sends crafted HTTP requests to the Content Server component, exploiting the flaw to read, alter, or delete content they should not be able to reach. Because of the high attack complexity, success depends on specific conditions being met, so exploitation is non-trivial and not reliably repeatable. No public exploit code was identified at the time of analysis.