WebCenter Content: Imaging CVE-2026-87377

Exploitation requires (1) a valid low-privileged account on the target WebCenter Content: Imaging 14.1.2.0.0 instance (PR:L - not unauthenticated), (2) network reachability to the SOAP interface of the Core component, and (3) satisfying high-complexity preconditions (AC:H) that place conditions outside the attacker's direct control, making reliable exploitation difficult. No end-user interaction is needed (UI:N). The authentication requirement and high attack complexity are the primary limiting factors that reduce real-world risk below what the network vector alone would suggest; only the specific affected version 14.1.2.0.0 is in scope.

This is a moderate-priority issue, not a top-tier emergency. The vendor-assigned CVSS 3.1 score of 6.8 (AV:N/AC:H/PR:L/UI:N) reflects a genuinely limited risk profile: while the attack vector is network-based via SOAP, exploitation is explicitly rated High complexity (AC:H) and requires an already-authenticated low-privileged account (PR:L), which meaningfully narrows the attacker population to insiders or those who have already obtained valid credentials. Impact is significant where it applies - High confidentiality and High integrity (C:H/I:H), meaning full read and unauthorized create/delete/modify access to all data reachable by the Imaging component - but there is no availability impact (A:N). No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the intelligence set, so there is no public exploit identified at time of analysis and no signal of active or widespread exploitation; this is consistent with a routine Oracle Critical Patch Update disclosure rather than an in-the-wild threat. CONFLICTING SIGNAL: the input Tags include 'Authentication Bypass', but the CVSS vector specifies PR:L (low-privileged attacker required), which directly contradicts an authentication-bypass characterization - the description describes a privilege/data-access flaw usable by an authenticated user, not a bypass of authentication. Treat the 'Authentication Bypass' tag as likely mislabeled and verify against the Oracle CPU advisory.

An attacker who already holds a low-privileged application account on an Oracle WebCenter Content: Imaging 14.1.2.0.0 instance crafts a malicious SOAP request to the Core component. By meeting the specific (high-complexity) conditions the flaw requires, they escalate their reach to read, create, delete, or modify critical data across all content accessible to the Imaging service. No public exploit code is known at time of analysis, and the high attack complexity makes reliable exploitation non-trivial.