Oracle WebCenter Content: Imaging CVE-2026-87376

Exploitation targets the Core component of Oracle WebCenter Content: Imaging version 14.1.2.0.0 specifically, reachable over the network via HTTP. The attacker must already possess a valid low-privileged account (PR:L) on the Imaging application - this is the primary limiting factor and rules out anonymous/unauthenticated attack. High attack complexity (AC:H) means success depends on additional conditions outside the attacker's direct control (e.g., specific timing, state, or configuration), which Oracle summarizes as 'difficult to exploit.' No end-user interaction is required (UI:N). The advisory does not name a specific feature toggle or non-default setting, so the condition is: authenticated low-privilege HTTP access to a running 14.1.2.0.0 Imaging instance plus satisfaction of the high-complexity preconditions.

This is a moderate-priority vulnerability (CVSS 3.1 6.8, Medium) whose real-world risk is tempered by two significant friction factors in the vector: AC:H (high attack complexity - Oracle's own wording 'Difficult to exploit') and PR:L (the attacker must already hold a low-privileged, authenticated account). Those gates meaningfully reduce the likelihood of opportunistic mass exploitation despite AV:N (network/HTTP) and UI:N (no user interaction). Impact is real where it lands: C:H and I:H mean full read and unauthorized create/delete/modify access to all data the Imaging component can reach, but A:N means no availability/denial-of-service impact. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or probable near-term exploitation - the score is driven by impact, not by demonstrated exploitability. Note a metadata conflict: the input Tag 'Authentication Bypass' contradicts the CVSS vector, which requires PR:L (an already-authenticated low-privilege user) rather than bypassing authentication - treat the 'Authentication Bypass' characterization as unverified. Overall this is a patch-in-normal-cycle item for Oracle WebCenter shops, not a drop-everything emergency, but it should be prioritized where low-privilege accounts are broadly provisioned.

An attacker who already holds a low-privileged application account on Oracle WebCenter Content: Imaging 14.1.2.0.0 crafts a specialized sequence of HTTP requests to the Core component to escalate their data access, reading or tampering with all data the Imaging service can reach. Because attack complexity is high, the attacker must satisfy specific non-trivial conditions or win a race/timing-dependent condition, so exploitation is not point-and-click. No public exploit code is identified at time of analysis.