WebCenter Imaging CVE-2026-87378

Exploitation requires the attacker to hold a valid low-privileged account on the target WebCenter Content: Imaging instance (CVSS PR:L - authenticated), with network HTTP access to the Core component; no user interaction and no non-default configuration are stated as prerequisites. The primary limiting factor is the authentication requirement: the attacker needs working credentials or self-registration ability on the Imaging application. Impact is confined to confidentiality - unauthorized read access to critical or all Imaging-accessible data - with no integrity or availability effect, so this cannot be used alone to alter data or take the service offline. Affected deployments are Oracle Fusion Middleware WebCenter Content: Imaging versions 12.2.1.4.0 and 14.1.2.0.0.

This is a moderate-priority vulnerability that should be patched in the normal Oracle Critical Patch Update cycle rather than treated as an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) describes a network-reachable, low-complexity attack requiring only low-level privileges and no user interaction, with impact limited strictly to confidentiality (C:H, I:N, A:N) - an attacker can read all data accessible to WebCenter Content: Imaging but cannot modify data or disrupt availability. No EPSS score, SSVC decision data, KEV listing, or POC was provided in the input, so exploitation-probability signals are absent; there is no public exploit identified at time of analysis and no evidence of active exploitation. The one notable conflict is the input tag 'Authentication Bypass', which contradicts the CVSS metric PR:L (the description explicitly states a 'low privileged attacker'); a genuine authentication bypass would imply PR:N, so this tag appears mislabeled and should not be used to escalate urgency. Overall this reads as a real but not critical issue: the authenticated prerequisite and confidentiality-only impact meaningfully reduce real-world risk compared to the raw 6.5 score.

An attacker who already holds a low-privileged WebCenter Content: Imaging account (for example a basic authenticated user) sends crafted HTTP requests to the Core component to access documents and data they should not be authorized to view. Because attack complexity is low and no user interaction is needed, a single compromised or self-registered low-tier credential can be leveraged to exfiltrate sensitive imaging content. No public exploit code was identified at time of analysis.