Oracle WebCenter Content CVE-2026-87399

Exploitation requires the attacker to hold a valid low-privileged account on the Oracle WebCenter Content Server (PR:L) reachable over HTTP, and critically requires human interaction from a different, typically higher-privileged user (UI:R) - the attacker cannot complete the attack alone and must lure or wait for a victim to interact with attacker-controlled content or a crafted request. The affected deployment is specifically Oracle WebCenter Content version 14.1.2.0.0 (Content Server component). Limiting factors that reduce real-world risk: valid credentials are mandatory (no anonymous exploitation), a second human must be induced to act, and there is no availability impact; the dependence on victim interaction makes this unsuitable for automated/wormable mass exploitation.

This is a moderate, not top-tier, priority. The CVSS 3.1 base score of 6.3 (MEDIUM) reflects a network-reachable HTTP vector (AV:N) with low attack complexity (AC:L), but exploitation is gated by two real limiters: the attacker must already hold low-level privileges (PR:L) and must induce a separate victim to perform an action (UI:R). The impact is asymmetric - high integrity impact (I:H: unauthorized create/delete/modify of critical or all accessible data) but only low confidentiality (C:L: read of a subset) and no availability impact (A:N) - which points to a stored-content or request-forgery style flaw where a planted payload acts in a victim's session rather than a straight data-exfiltration bug. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no evidence of active or imminent exploitation; the realistic risk today is bounded by the need for valid (even if low-privilege) credentials plus victim interaction. SIGNAL CONFLICT TO VERIFY: the input Tags include 'Authentication Bypass,' but the CVSS vector and Oracle's description explicitly require an authenticated low-privileged attacker (PR:L) and human interaction - this is contradictory and the tag appears mislabeled; this CVE is not an unauthenticated auth-bypass. CWE is 'N/A' and the only references are Oracle's October 2026 CPU landing page and the NVD mirror, so technical root-cause detail is thin.

A low-privileged authenticated user of Oracle WebCenter Content plants a crafted item or link within the Content Server; when a higher-value user (e.g., a content administrator or reviewer) interacts with it in their session, the payload performs unauthorized creation, modification, or deletion of critical content on their behalf. No public exploit code or active-exploitation evidence was identified at the time of analysis, so this remains a theoretical chain based on the CVSS vector.