WebCenter Content: Imaging CVE-2026-87391

Exploitation requires the attacker to already possess a HIGH-privileged account with logon access to the infrastructure where WebCenter Content: Imaging executes (local vector, not network-reachable), AND it requires human interaction from a different, separate user to complete the attack. These two factors together sharply limit real-world exploitability: there is no remote or unauthenticated path, and the dependency on a victim's action means purely automated or opportunistic exploitation is not feasible. Only confidentiality is affected (no integrity or availability impact), but the scope change means disclosure can reach additional Fusion Middleware products co-located with the Imaging component. Affected deployments are limited to versions 12.2.1.4.0 and 14.1.2.0.0.

This is a moderate-severity, low-urgency issue despite its enterprise context. All signals point the same direction and are internally consistent: the CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N, base 5.5) requires the attacker to already have an authenticated, HIGH-privileged logon to the host where WebCenter Content: Imaging runs, plus human interaction from a separate victim. These two prerequisites (privileged local access AND social engineering of another user) substantially narrow the realistic attacker population - this is not a remotely weaponizable flaw. The only impact is confidentiality (C:H), with no integrity or availability effect, though the scope change (S:C) means the disclosed data can extend to additional co-located Fusion Middleware products. No EPSS score, CISA KEV listing, or public POC is present in the provided data, and there is no indication of active exploitation. Net: a legitimate patch-management item for the October 2026 Oracle CPU cycle, but not an emergency - the high-privilege-plus-user-interaction gate makes mass or opportunistic exploitation unlikely, pointing toward (at most) insider or post-compromise misuse rather than widespread attack.

An attacker who already holds high-privilege logon access to the server running WebCenter Content: Imaging stages malicious content or a crafted request, then induces a separate, more-privileged user to perform an action that triggers the flaw. The resulting disclosure grants unauthorized read access to critical WebCenter Content: Imaging data and, due to the scope change, potentially data in co-located Fusion Middleware products. No public exploit identified at time of analysis, so any attack would require custom development.